Google's September 2026 Pixel Update Bulletin contains patches beyond what's in that month's regular Android Security Bulletin. According to GrapheneOS, some of those extra patches touch standard Android platform code, the kind that runs on non-Pixel devices, not just Pixel-branded hardware.
None of that platform-level code has reached the regular monthly bulletin or the private preview patches other manufacturers typically draw from to get their own patches ready.
And at this rate, these won't reach non-Pixel OEMs at all until Android 17 QPR2 ships later this year in December.
The project is characterizing this as Google "gatekeeping security patches to the standard Android platform code from Android OEMs." The complaints
GrapheneOS says Android 17 QPR1 shipped new developer APIs that never made it into AOSP. This is something they claim hasn't happened since Android's Honeycomb days.
Google's API diff report backs this up. Comparing Android 17 to QPR1 shows one new package, android.hardware.hid, plus changes across sixteen others, including android.media, android.os, android.provider, android.telecom, and android.view.
GrapheneOS has ported its code to QPR1 before Google even released it, but still doesn't have permission to ship that work. For now, the project is backporting Pixel firmware, kernel drivers, userspace drivers, and HALs from QPR1 onto Android 17 instead.
On top of all that, there's a compliance issue that seems to be recurring.
Google was slow to comply with a GPL source request. GrapheneOS requested sources for a build (CD1A.260905.001.A1) on September 1, and access only came through more than two weeks later.
Why this is worrying
None of these three issues is catastrophic by itself. A three-month patch delay, a paused API rollout, a two-week wait on source code—each is the kind of thing that could pass as a one-off.
Taken together, however, they point to a recurring theme. Google is holding security fixes back from the wider Android ecosystem, withholding new APIs from AOSP for the first time in over a decade, and slow-walking GPL compliance it's required to meet.
Don't even get me started on what they are doing to the Android app ecosystem.
Google is on track to require every Android app developer, whether on the Play Store, F-Droid, or anywhere else, to register with them. Come 2027, that means handing over legal identification and signing key evidence before an app can run on any certified device.
Sideloading an unverified app following this would mean enabling developer settings, waiting through a mandatory 24-hour cooldown, and clicking past several warning screens (classic scare tactics, btw).
GrapheneOS is one of dozens of organizations that signed onto the Keep Android Open campaign opposing this, alongside F-Droid, the Electronic Frontier Foundation, and the Free Software Foundation.
If you ask me, this Big Tech company is doing what's regrettably natural for it, clamping down open access to things so that its competition cannot benefit.
77 Comments
ZkhqrD5o@lemmy.world · 217 pts · 2d
It's called installing apps, not "sideloading". Installing your programmes into a device you own is normal, being blocked from doing that is abnormal.
jaypatelani@lemmy.ml · 107 pts · 2d
We need Proper Linux/BSD phone
AHemlocksLie@lemmy.zip · 28 pts · 2d
PostmarketOS works pretty decently on certain hardware from my understanding. Apps are lacking, though. I think you might be able to run Android apps through something like Waydroid, but I think certain apps like bank apps don't like that.
jaypatelani@lemmy.ml · 5 pts · 2d
Yeah I mean with Posh based on kde based but with native Linux app ecosystem.
GotExx@lemmy.ml · 9 pts · 2d
SailfishOS phone ?
AHemlocksLie@lemmy.zip · 15 pts · 2d
Yeah, not, I'm not buying a corporate owned phone again so we can repeat this later. Fully open source should be the goal.
mofongo@discuss.tchncs.de · 2 pts · 2d
Furiphone?
SwooshBakery624@programming.dev · 1 pts · 1d
Proprietary crap phone?
wry@sh.itjust.works · 2 pts · 1d
Not to mention way too expensive as well...
bad1080@piefed.social · -9 pts · 2d
i mean there is AOSP
4am@lemmy.zip · 79 pts · 2d
This was already the inevitability of Android; Google was just willing to spend 15-20 years to achieve as much market dominance as possible. They fought off Palm webOS, Windows Mobile, Linux phones are just now materializing, iOS is huge but having one major competitor isn’t a problem. Now that “the reality of the world means more security is needed” Google will work their way out of any openness they once had. Perhaps even someday their own hardware will be the only game in town. They’re already by FAR the worst company when it comes to harvesting data and profiling you.
jjlinux@lemmy.zip · 18 pts · 2d
Agree 99%. But I would argue that Google is on par with Meta on the profiling front.
0x0@lemmy.zip · 3 pts · 1d
It's called embrace, extend, extinguish.
Microsoft pioneered it.
DutchJ@lemmy.zip · 75 pts · 2d
Honestly, I am running GrapheneOS (o7 to the devs, btw) until my Pixel 6a dies, and then I am switching to Jolla + SailfishOS. There is nothing more maddening to me than seeing Microslop and Google slowly filling their ecosystem with irremovable invasive bloatware and basically blocking a free market.
defaultusername@lemmy.dbzer0.com · 30 pts · 2d
If you don't already have the Jolla hardware, I'd consider getting a Fairphone 6 or 6+ instead and using TheMightyCat's build of postmarketOS. They've been doing some insane work with hardware enablement on the close-to-mainline kernel for that phone to the point where it's almost 100% fully functional.
sudoer777@lemmy.ml · 2 pts · 2d
Does it work with other distros also? My phone is about to lose GrapheneOS support and hope to replace it with a Linux phone one day
defaultusername@lemmy.dbzer0.com · 2 pts · 2d
The Fairphone 6 and 6+ can theoretically work with any distro that has 64 bit ARM support. The close-to-mainline kernel fork is where most of the important work is being done, and the rest is in portable open source software (like VoLTE support in userspace, for example).
sudoer777@lemmy.ml · 1 pts · 2d
Sick I'll check back in a few months when the GrapaheneOS phone releases and see if I should get that instead (kind of depressed about the state of Linux ARM laptops tho, Asahi Linux was great but the hardware is EOL now)
defaultusername@lemmy.dbzer0.com · 1 pts · 1d
When it comes to laptops, I'm personally sticking with x86 until there are faster RISC-V CPUs available that I can daily drive in a laptop.
Even though ARM has much better battery life compared to x86, I'd still just be trading one proprietary architecture for another.
sudoer777@lemmy.ml · 1 pts · 1d
The current ARM chips at least don't seem to have stuff like Intel ME, the integrated GPUs are much better as well especially for running AI models. Power efficiency as well, Intel at least is getting close but still behind. Also memory tagging. The Intel/AMD duopoly is getting old.
defaultusername@lemmy.dbzer0.com · 1 pts · 1d
When it comes to an ME/PSP analog, there is ARM TrustZone, but each vendor has their own implementation, so whether or not it constantly runs in the background, has full access to system memory, and is completely proprietary is up to each vendor. When it comes to phones and laptops that support cellular connections on the other hand, the integrated baseband, which also has full access to system RAM and is proprietary would be my main concern.
RISC-V has a memory tagging implementation: https://github.com/riscv/riscv-memory-tagging/tree/main
Both AMD and Intel are working together on an x86 memory tagging implementation called ChkTag: https://community.intel.com/t5/Blogs/Tech-Innovation/open-intel/ChkTag-x86-Memory-Safety/post/1721490
AMD iGPUs are hard to beat for things like gaming. IDK much about running AI models, since I don't care much about that kind of stuff.
Power efficiency is really the only thing that ARM has over x86. Also RISC-V theoretically has better power efficiency compared to ARM, though since RISC-V is so new, more advanced implementations would need to be developed first in order to match the performance per watt in a full-fledged desktop-class CPU.
eleitl@lemmy.zip · 14 pts · 2d
We'll see what Motorola will cook up. Of course GOS team can't maintain an Android fork on their own. It doesn't need new features, just stability and security on the right hardware platform. And it's too bad Google killed the Pixel tablets. There isn't anything new supported on LineageOS either. Seems I have to bite the bullet, and look at Linux tablets.
0x0@lemmy.zip · 1 pts · 1d
Isn't that what they've been doing?
eleitl@lemmy.zip · 2 pts · 1d
It would be hard fork vs a soft fork. A lot more work. But in principle a project that doesn't need features but stability is viable. See *BSD.
JustEnoughDucks@slrpnk.net · 9 pts · 2d
Sadly, security on the Jolla is laughable. Comparable to a standard Linux installation years ago, from what I have heard...
It is so dumb that pretty much we only have to make these giant compromises because of greed.
DutchJ@lemmy.zip · 14 pts · 2d
For me, having control over my own system outweighs this. Might be naive though. Plus, I want to support these kind of initiatives.
eyekaytee@lemmy.world · 2 pts · 2d
grue@lemmy.world · 64 pts · 2d
When is some country's government finally going to grow a pair and block this shit on the grounds of antitrust law?
greatwhitebuffalo41@slrpnk.net · 21 pts · 2d
Only when they stop getting some kind of benefit from it.
dropdrip@lemmy.ml · 12 pts · 2d
Most governments are fascists. They want what Google is working towards: a certified device. Once you have a platform that the majority owns and is certified you can start rolling out more fascist policies, like identity verification for asinine things. The American courts failed a long time ago in regards to software with Microsoft. You could make cases against Google decades ago, but literally no one cares for some reason.
username123@sh.itjust.works · 1 pts · 1d
Complacency is stupidity.
0x0@lemmy.zip · 2 pts · 1d
Maybe Spain.
qonqe@lemmy.zip · 4 pts · 1d
Spain??? Absolutely not. In fact, the new EU "Digital ID App" is going to require having a "Google or Apple verified device" for it to work. They are all in favour of restricting the internet behind IDs. Spanish President openly talked about abolishing anonymity to "protect us". And the opposition is even worse.
0x0@lemmy.zip · 2 pts · 1d
The EU digital act is not Spain's digital act. Regardless, being pro-Palestine and anti-NATO doesn't necessarily make Sanchez tech-savy.
master_baiter@programming.dev · 34 pts · 2d
google doing as best as it possibly can to turn android into iOS but with none of the benefits
TrollAccount69@lemmy.ml · -8 pts · 1d
I honestly see it the opposite way. Graphene is doing their level best to turn Android into iOS with none of the benefits.
They’re doing all the stuff apple did for hardware except they can’t make their own so they’re chasing stuff with the security features of iphones, they’re rewriting the system apps to take advantage of those features (like apple did) but they don’t have the benefit of a cloud data system or oversight of their app marketplace.
I use graphene and ios daily. It’s really interesting how they’re going about all this.
DeadEndLink@lemmy.ca · 1 pts · 1d
Seems like Apple should just stop being a shitty corporation then, all our problems are solved.
TrollAccount69@lemmy.ml · 1 pts · 1d
Huh?
cerebralhawks@lemmy.dbzer0.com · 33 pts · 2d
I've been trying to convince people for the last 10-15 years that Google is no friend to the open source community. It's been difficult and sounds self-serving as I do it from Apple devices and make no attempt to hide or conceal that.
AOSP and chromium are open source projects. What Google actually puts out — Android and Chrome — are not. They take the open source foundations, and they build upon them with closed-source components. They've always done this. AOSP does not have any Google apps either (sometimes called GApps) as those are not open source. Browser and Mail are not Chrome and Gmail, though the former may be a chromium-based browser and the latter may be capable of retrieving and sending through Gmail (much like Apple's mail app can).
Android is not an open source ally, and macOS is kinda, sorta, not really based on UNIX. But we could flip the script and say that Apple is a friend to open source because macOS is basically UNIX (via OS X and NextStep), while Android isn't open source at all. I can already see the pitchforks being sharpened. Both positives are technically true from a certain point of view (like Vader having killed Anakin Skywalker, to use Obi-Wan's example for this turn of a phrase), but the negatives of both are more accurate. Because to really be a friend to the world of open source (and FOSS, and the more preferred licenses), you can't just half-ass it, you gotta go all the way. Apple isn't there and neither is Google.
F-Droid is what the Android Market (I'm that old, and older) should have become, with Google offering a repository you can add to F-Droid. Google Play Store is trash and pretty much always has been, and I say that as someone who deals with the App Store (which is also trash) every day.
Of course I also root for GrapheneOS, up until they say you can only use their OS with a Pixel phone. If I want iPhone 11 performance, I'm not spending iPhone 18 Pro money on a Pixel 11, I'm gonna either get iPhone 18 Pro performance, or, if I want Android, I'm looking at the Galaxy S line. I'm not even looking at Pixel and its sorry ass, seven generations behind Tensor line. Bad enough Snapdragon struggles to keep up with Apple silicon. Does Tensor even try?
But nah, I wanna see GrapheneOS do what Andy Rubin did. Make Linux run on phones. But make it run on any phone. I guess I don't mean "including the iPhone." That would be nice, but Apple isn't unlocking that bootloader. But we should expect a free, open source alternative to Android to run on any hardware, not just the one run by the one causing the problems. (So what standards do I aspire my iPhone to? I want it to be more like the Mac, with a terminal and ability to install apps from anywhere.)
HobbitFoot@thelemmy.club · 9 pts · 2d
Google used open source as cover to to illegally dump into different industries to expand its monopoly. It did the bare minimum to prepare for the antitrust litigation that never came.
TrollAccount69@lemmy.ml · 1 pts · 2d
I use both graphene and ios and graphene on pixels is even slower than pixels are by default.
DieserTypMatthias@lemmy.ml · 29 pts · 2d
Honestly we really need a phone with a proper Linux distro that does have same hardening as Graphene and also underclocks the modem and the rest when idle.
stinkytofuisgood@lemmy.ca · 29 pts · 2d
When Sony announced the end of physical disks, a low level exploit for the PS5 was released - to me the timing of this makes the message clear.
I hope we soon have some sort of similar response with Google, whatever that may be.
We are reaching a point where it's evident we need to really start seriously developing open source alternatives for the technology in our life that is essentially gated by duopolies, monopolies, and oligopolies...
Thanks to the auther for publishing important news like this. Spreading the word is so important. Making it understandable to the average person equally so. We need to educate the youth in particular before they become irreversibly entrenched in an even worse tech corpo-dystopia.
Also, if any Grapheneos devs are reading this, I love you guys and I respect the hell outta the work you're putting in. Anyone who has the means and the passion, I'm sure they wouldn't mind a donation or even just feedback and engagement.
suvtropics@lemmy.world · 25 pts · 2d
We're headed a dark direction. One reason I find little interest in android, smartphones, pc building, gaming hobby despite being a tech enthusiast.
boa@sh.itjust.works · 6 pts · 1d
One can buy low powered devices rp, esp32 low budget pc laptop to play and setting up home servers.
CaffeinatedCubits@programming.dev · 10 pts · 1d
We really need a better OS than Android.
wry@sh.itjust.works · 1 pts · 1d
I keep trying to tell people that Graphene is a dead end. There are other options we should be pursuing.
auzy1@lemmy.world · 9 pts · 2d
Steam lepton is interesting.
It's almost like steam is also possibly going after the play store eventually too. So, if they do that, and manufacturers change away, it's a win
melfie@lemmy.zip · 5 pts · 2d
I’m not sure if Lepton improves on Waydroid for general apps as well, or just games. It would be great to see more weight behind Linux phones, but not sure if Valve intends to do it or not.
loutr@sh.itjust.works · 5 pts · 2d
It says on the repo that the scope is limited to games only. Other apps may work but they're not actively supported, and APIs not used by games won't be implemented.
auzy1@lemmy.world · 1 pts · 2d
That makes sense.. As, for gaming, you'd make the windows full sized, and they can just use gamescope.
But, doesn't mean it can't be improved long term
FreddiesLantern@leminal.space · 8 pts · 2d
Join forces with postmarketOS?
I mean I'm well aware that they won't be taking any of their work over to that platform but they are expanding their hardware support pretty wide and it's full on linux afaik.
altkey@lemmy.dbzer0.com · 6 pts · 2d
If we assume Google is a wiggledog of alphabet (lel) agencies, it would want to wiggle off all deviants and provide a single platform one can exploit in a predictable way and not others. In a subscription-model fashion, they benefit from having an ever moving window of vulnerabilities so their clients need to get the latest ones or otherwise they wouldn't work. I slightly remember an article concerning russian cops using old Pegasus to dig into someone's iphone and israelis commenting that it is outdated by a couple of years and is not applicable to modern models.
Privacy-focused OSes and apps out of their control introduce deviances Google doesn't want to account for, so they establish a total monopoly.
There should be something more than we have now to tell Google should cool the fuck down.
username123@sh.itjust.works · 1 pts · 1d
In the past we used to say we had functioning regulatory bodies, but they were getting paid for their silence then, and even more now.
0x0@lemmy.zip · 5 pts · 1d
Ramp up Motorola then.
story@lemmy.zip · 5 pts · 2d
I'm team graphene despite having returned to the cathedral. they need thousands of dollars of our money to free up their time for the things they prioritize: this is very much a theo de raadt situation. the phone landscape is imperfect, we must take what we can get, whatever is maximum security and maintains the free software principles, projects like Android ports of self-hosted clients must continue to poison the Google narrative. it is the job of the less-skilled to serve as patron for the people who hold up the internet
Crozekiel@lemmy.zip · 4 pts · 1d
This has always been a thought in the back of my head regarding GrapheneOS and why I never bought into the fan hype around it. Google has always been 100% in control of the door letting these AOSP projects function and they have been slowly closing the door for ages now. It will be fully closed at some point.
OhVenus_Baby@lemmy.ml · 4 pts · 2d
Don't forget everyone! Cheering on Motorola is no good feat. When the Flock cameras are getting take down. Guess who's placing new cameras in the exact same places as the Flock poles. Axon and Motorola. Still want your Graphene phone on Motorola? Not a good sign.
wylinka@szmer.info · 25 pts · 2d
Motorola Solutions != Motorola Mobility
Motorola Mobility is Lenovo and since 2014 they have nothing to do with each other apart from the branding.
OhVenus_Baby@lemmy.ml · 0 pts · 2d
What a shit coincidence.
LeftReddit2@lemmy.world · 2 pts · 1d
How do we get the average person to care about this? Like okay, as dumb as I am with tech, I probably am more techy than the average layman.
And guess what, they do NOT care about this shit. Most of my non-tech friends still think GrapheneOS is a thing criminals or paranoid schizophrenics use.
They also tend to not care about age verification things. "So what, you show ID at the bar or store to get alcohol, what do I care?"
Like really gamers, how can we make the common person care about this at all? How can we communicate to them it matters and will impact them?
DeadEndLink@lemmy.ca · 1 pts · 1d
I'm picturing the GrapheneOS branded sliding scale spectrum of criminal to paranoid schizophrenic, built into my personal device features.
eleijeep@piefed.social · 2 pts · 2d
Huh? What do they need permission for?
I had no idea that GrapheneOS was so dependent on Android as an upstream project.
eleitl@lemmy.zip · 7 pts · 2d
It's about Pixel specifics. I hope next year there is an alternative.
pastermil@sh.itjust.works · 1 pts · 2d
Why doesn't Graphene support other phones?
ch00f@lemmy.world · 6 pts · 2d
They're working on some Motorola models.
Ferk@lemmy.ml · 2 pts · 1d
I didn't know this, that's great! More info here:
I hope it works out and we start seeing more manufacturers explicitly offering compatibility.
SpaceCrystal@lemmy.ml · 2 pts · 2d
I’ll be waiting on Motorola’s newest 2027 models for this reason. Google can go to hell.
0x0@lemmy.zip · 3 pts · 1d
Something something security only google can provide.
pastermil@sh.itjust.works · 1 pts · 1d
Like is it a hardware thing, and something other manufacturers cannot have for some reason?
dafta@lemmy.blahaj.zone · 6 pts · 1d
It's a hardware thing, but it'a not something other manufacturers can't have, it's just that they currently don't have it. GrapheneOS is working with Motorola to create phones that satisfy their hardware requirements and they're coming out in 2027.
darkangelazuarl@lemmy.world · 1 pts · 1d
Its a hardware thing but its also more complicated. Many manufacturers don't some of these features because add android does not require it. Even Google's latest pixel 11 may not have all the security requirements set by grapheneOS. I'd like to see them push for these requires in upstream AOSP. They already have a track record of contributions to upstream AOSP.
comrademiao@piefed.social · -14 pts · 2d
Graphene's team is never happy. If no one picked a fight with them they would find one.
mlfh@lm.mlfh.org · 27 pts · 2d
That's good, that's the whole point - if there were nothing wrong with android/google worth picking a fight over, graphene wouldn't need to exist in the first place.
I want my graphene/EFF/etc teams rabid, angry, picking fights, and armed with bazookas.
comrademiao@piefed.social · -1 pts · 2d
They’re wildly unprofessional with no decorum, providing me zero ability to trust them unlike most other FOSS
I also disagree being unhappy and picking fights is the point. Their creator stepped down for a reason.
username123@sh.itjust.works · 0 pts · 1d
Oh no muh decorum.
comrademiao@piefed.social · 2 pts · 17h
Thank you for reminding me that interacting with online users is a waste of time.
username123@sh.itjust.works · 1 pts · 17h
You’re welcome. I’m sure the hills you chose to die on and your pretentiousness will make for great company in your lonesome fantasy world. The difference between dumb elitism and constructive criticism is the usefulness and adaptability. I’m thankful for the work the Graphene devs are doing despite some immaturity displayed. No-one else is filling that gap anywhere near as well. If you go around trying to boycott everything made by people who don’t hold up to your asinine standards you wouldn’t be able to survive. I dare you to take a good look at the workers behind everything you consume.