Google’s September 2026 Pixel Update Bulletin contains patches beyond what’s in that month’s regular Android Security Bulletin. According to GrapheneOS, some of those extra patches touch standard Android platform code, the kind that runs on non-Pixel devices, not just Pixel-branded hardware.
None of that platform-level code has reached the regular monthly bulletin or the private preview patches other manufacturers typically draw from to get their own patches ready.
And at this rate, these won’t reach non-Pixel OEMs at all until Android 17 QPR2 ships later this year in December.
The project is characterizing this as Google “gatekeeping security patches to the standard Android platform code from Android OEMs.” The complaints
GrapheneOS says Android 17 QPR1 shipped new developer APIs that never made it into AOSP. This is something they claim hasn’t happened since Android’s Honeycomb days.
Google’s API diff report backs this up. Comparing Android 17 to QPR1 shows one new package, android.hardware.hid, plus changes across sixteen others, including android.media, android.os, android.provider, android.telecom, and android.view.
GrapheneOS has ported its code to QPR1 before Google even released it, but still doesn’t have permission to ship that work. For now, the project is backporting Pixel firmware, kernel drivers, userspace drivers, and HALs from QPR1 onto Android 17 instead.
On top of all that, there’s a compliance issue that seems to be recurring.
Google was slow to comply with a GPL source request. GrapheneOS requested sources for a build (CD1A.260905.001.A1) on September 1, and access only came through more than two weeks later.
Why this is worrying
None of these three issues is catastrophic by itself. A three-month patch delay, a paused API rollout, a two-week wait on source code—each is the kind of thing that could pass as a one-off.
Taken together, however, they point to a recurring theme. Google is holding security fixes back from the wider Android ecosystem, withholding new APIs from AOSP for the first time in over a decade, and slow-walking GPL compliance it’s required to meet.
Don’t even get me started on what they are doing to the Android app ecosystem.
Google is on track to require every Android app developer, whether on the Play Store, F-Droid, or anywhere else, to register with them. Come 2027, that means handing over legal identification and signing key evidence before an app can run on any certified device.
Sideloading an unverified app following this would mean enabling developer settings, waiting through a mandatory 24-hour cooldown, and clicking past several warning screens (classic scare tactics, btw).
GrapheneOS is one of dozens of organizations that signed onto the Keep Android Open campaign opposing this, alongside F-Droid, the Electronic Frontier Foundation, and the Free Software Foundation.
If you ask me, this Big Tech company is doing what’s regrettably natural for it, clamping down open access to things so that its competition cannot benefit.
How do we get the average person to care about this? Like okay, as dumb as I am with tech, I probably am more techy than the average layman.
And guess what, they do NOT care about this shit. Most of my non-tech friends still think GrapheneOS is a thing criminals or paranoid schizophrenics use.
They also tend to not care about age verification things. “So what, you show ID at the bar or store to get alcohol, what do I care?”
Like really gamers, how can we make the common person care about this at all? How can we communicate to them it matters and will impact them?
We really need a better OS than Android.
This has always been a thought in the back of my head regarding GrapheneOS and why I never bought into the fan hype around it. Google has always been 100% in control of the door letting these AOSP projects function and they have been slowly closing the door for ages now. It will be fully closed at some point.
Ramp up Motorola then.
I’m team graphene despite having returned to the cathedral. they need thousands of dollars of our money to free up their time for the things they prioritize: this is very much a theo de raadt situation. the phone landscape is imperfect, we must take what we can get, whatever is maximum security and maintains the free software principles, projects like Android ports of self-hosted clients must continue to poison the Google narrative. it is the job of the less-skilled to serve as patron for the people who hold up the internet
We’re headed a dark direction. One reason I find little interest in android, smartphones, pc building, gaming hobby despite being a tech enthusiast.
One can buy low powered devices rp, esp32 low budget pc laptop to play and setting up home servers.
The writing has been on the wall for years now [Article from 2018]
Why doesn’t Graphene support other phones?
Something something security only google can provide.
Like is it a hardware thing, and something other manufacturers cannot have for some reason?
It’s a hardware thing, but it’a not something other manufacturers can’t have, it’s just that they currently don’t have it. GrapheneOS is working with Motorola to create phones that satisfy their hardware requirements and they’re coming out in 2027.
They’re working on some Motorola models.
I didn’t know this, that’s great! More info here:
Together, Motorola and the GrapheneOS Foundation will work to strengthen smartphone security and collaborate on future devices engineered with GrapheneOS compatibility.
“We are thrilled to be partnering with Motorola to bring GrapheneOS’s industry‑leading privacy and security‑focused mobile operating system to their next-generation smartphone”, said a spokesperson at GrapheneOS. “This collaboration marks a significant milestone in expanding the reach of GrapheneOS, and we applaud Motorola for taking this meaningful step towards advancing mobile security.”
I hope it works out and we start seeing more manufacturers explicitly offering compatibility.
I’ll be waiting on Motorola’s newest 2027 models for this reason. Google can go to hell.
Honestly we really need a phone with a proper Linux distro that does have same hardening as Graphene and also underclocks the modem when idle.
google doing as best as it possibly can to turn android into iOS but with none of the benefits
I honestly see it the opposite way. Graphene is doing their level best to turn Android into iOS with none of the benefits.
They’re doing all the stuff apple did for hardware except they can’t make their own so they’re chasing stuff with the security features of iphones, they’re rewriting the system apps to take advantage of those features (like apple did) but they don’t have the benefit of a cloud data system or oversight of their app marketplace.
I use graphene and ios daily. It’s really interesting how they’re going about all this.
Seems like Apple should just stop being a shitty corporation then, all our problems are solved.
When Sony announced the end of physical disks, a low level exploit for the PS5 was released - to me the timing of this makes the message clear.
I hope we soon have some sort of similar response with Google, whatever that may be.
We are reaching a point where it’s evident we need to really start seriously developing open source alternatives for the technology in our life that is essentially gated by duopolies, monopolies, and oligopolies…
Thanks to the auther for publishing important news like this. Spreading the word is so important. Making it understandable to the average person equally so. We need to educate the youth in particular before they become irreversibly entrenched in an even worse tech corpo-dystopia.
Also, if any Grapheneos devs are reading this, I love you guys and I respect the hell outta the work you’re putting in. Anyone who has the means and the passion, I’m sure they wouldn’t mind a donation or even just feedback and engagement.
Don’t forget everyone! Cheering on Motorola is no good feat. When the Flock cameras are getting take down. Guess who’s placing new cameras in the exact same places as the Flock poles. Axon and Motorola. Still want your Graphene phone on Motorola? Not a good sign.
Motorola Solutions != Motorola Mobility
Motorola Mobility is Lenovo and since 2014 they have nothing to do with each other apart from the branding.
What a shit coincidence.
Graphene’s team is never happy. If no one picked a fight with them they would find one.
That’s good, that’s the whole point - if there were nothing wrong with android/google worth picking a fight over, graphene wouldn’t need to exist in the first place.
I want my graphene/EFF/etc teams rabid, angry, picking fights, and armed with bazookas.
They’re wildly unprofessional with no decorum, providing me zero ability to trust them unlike most other FOSS
I also disagree being unhappy and picking fights is the point. Their creator stepped down for a reason.
Oh no muh decorum.
We need Proper Linux/BSD phone
PostmarketOS works pretty decently on certain hardware from my understanding. Apps are lacking, though. I think you might be able to run Android apps through something like Waydroid, but I think certain apps like bank apps don’t like that.
Yeah I mean with Posh based on kde based but with native Linux app ecosystem.
The list of well supported phones is vanishingly small & what’s even worse is that it’s not really daily drivable on any device. The idle battery drain is immense with the modem on. Honestly I’m not even certain that without a proper relationship with the hardware vendors it’s possible to build something that doesn’t drain itself in 2 days of idling.
Two days? I charged every night even when using Google’s OS.
Did you use the phone at all? 2 days of idling, to me, implies never turning on the screen or opening any apps
If I don’t use my phone for two days I’d just shut it off. So no but it seemed so absurd I just it ignored it.
i mean there is AOSP
And AOSP is purposefully falling behind
How so?
Many AOSP apps are dated and Google has its own closed source Google apps.
SailfishOS phone ?
Proprietary crap phone?
Not to mention way too expensive as well…
Furiphone?
Yeah, not, I’m not buying a corporate owned phone again so we can repeat this later. Fully open source should be the goal.
Lmao good luck
Lmao good luck
Jolla is a startup that is taking advantage of foss being free & are not really contributing back. All the innovations they made to actually make their Linux phone usable is lost to the community at large.
I think we need something similar to the Lenovo + Graphene collab. Mass produced phones sold at commodity prices with a usable Linux option.
The company has been around for like 15 years I don’t think you can call them a startup anymore
Can you elaborate on this? I am planning to preorder a Jolla phone, bad idea in your opninion?
To add to the other commenters reply;
When Jolla does something, like make new software or patches, most of that is proprietary. They’re creating their own thing, and nobody outside Jolla can benefit from their work. That’s fine, but pretty much equivalent to any other corporate-owned mobile OS in terms of freedom, like Google’s Android.
There’s more open options, but they all have their differences. Ubuntu Touch (or really anything on UBPorts) has some components you would also find on Linux, but still uses the OEM kernel and proprietary Android device drivers. This means that devices are much more likely to work, but you rely on the OEM to maintain support for the device on Android. postmarketOS (and others, like Mobian) try to build most things from scratch instead. This means less hardware is supported, and functionality is often not great. However, all development is open, and they’re trying to ensure there’s little to no reliance on OEMs. This theoretically makes for much better (community supported) future proofing.
If you want a fully open source Linux phone, the best option is to get whatever is supported by a mobile distro. I think PostmarketOS has some of the best support, but I may be mistaken. There’s also Ubuntu Touch, Mobian, and I want to say one more I’m forgetting.
That one is not fully open source. I understand why, but I don’t like it.
Google is on track to require every Android app developer, whether on the Play Store, F-Droid, or anywhere else, to register with them. Come 2027, that means handing over legal identification and signing key evidence before an app can run on any certified device.
When is some country’s government finally going to grow a pair and block this shit on the grounds of antitrust law?
Maybe Spain.
Spain??? Absolutely not. In fact, the new EU “Digital ID App” is going to require having a “Google or Apple verified device” for it to work. They are all in favour of restricting the internet behind IDs. Spanish President openly talked about abolishing anonymity to “protect us”. And the opposition is even worse.
The EU digital act is not Spain’s digital act. Regardless, being pro-Palestine and anti-NATO doesn’t necessarily make Sanchez tech-savy.
Most governments are fascists. They want what Google is working towards: a certified device. Once you have a platform that the majority owns and is certified you can start rolling out more fascist policies, like identity verification for asinine things. The American courts failed a long time ago in regards to software with Microsoft. You could make cases against Google decades ago, but literally no one cares for some reason.
Only when they stop getting some kind of benefit from it.
