Skip to content

GrapheneOS Monthly Summary

Release summaries for GrapheneOS, aggregated by month. Over the past four months a new release landed every six days on average, and the version number is just the release date (2026081300, for example), so going release by release tells you very little. This page groups each month into one entry and answers three questions: how far the Android security patch level advanced, which everyday features got fixed, and whether device support changed. Newest month at the top.

GrapheneOS updates automatically in the background, so ordinary users need to do nothing on account of this page. It is here for people who want to know what is happening underneath, or who need to explain to a team why they chose this OS.

Source data comes from the official releases page. The official atom feed keeps only the last 20 entries (roughly four months), so anything older has to be looked up on the site.

October 2026

Releases 2026100200, 2026100600 · Official releases

  • 2026100600 on 6 October brings the full 2026-10-05 security patch level and the October Pixel firmware, the same day as Google's Pixel Update Bulletin. The October bulletin is summarised in Android Security Patch Levels.
  • The security preview release (2026100601) now covers patches Google has scheduled for its November 2026 to April 2027 bulletins. The list of additional fixed CVEs has 122 entries (8 Critical, 114 High); the October batch has been published officially and dropped off the list.
  • Fixed an upstream integer overflow in ZipFileRO.cpp that caused memory corruption with a ZIP entry name of 65,535 bytes.
  • system_server JARs and non-APEX APKs are now always compiled ahead of time with the speed compiler filter, instead of speed-profile when a profile exists; GrapheneOS says this improves core OS performance.
  • Seedvault (the system backup tool) moves to the latest upstream Android 17 branch in place of GrapheneOS's own port, along with fixes for a batch of bugs and interface problems.
  • The 2 October release disabled unprivileged hardware keepalives (keepalive packets the network chip sends on an app's behalf). GrapheneOS states they create a VPN leak, so they are turned off.
  • The listed security patch level rises to 2026-09-05. The release notes say the 2026-09-05 patches had already been in place for a while, and the previous release brought in all the Pixel firmware and driver updates from Android 17 QPR1, so the listed level now reflects that. The cellular modem flaw CVE-2026-58704 from the September entry sits in the 2026-09-05 level; the notes still do not name it.
  • The Pixel kernel restores the Android 17 (CP2A) mmap read-ahead behaviour, fixing stutter under memory pressure caused by an upstream change in QPR1.
  • Fixed an upstream Android bug that set the last-modified time of files restored from Android backups to January 1970, because seconds were passed to an API expecting milliseconds.
  • All four kernel lines (6.1, 6.6, 6.12, 6.18) moved to the latest GKI LTS revisions, with 6.18 reaching 6.18.33 on 2 October and 6.12 reaching 6.12.94 on 6 October.
  • Vanadium moved to 154.0.8037.92.0 on 2 October, matching Chrome's 29 September stable release, then to 154.0.8037.126.0 on 6 October.
  • Device coverage runs from Pixel 6 to Pixel 10a, unchanged.

September 2026

Releases 2026090500, 2026090700, 2026091000, 2026091700, 2026091900, 2026092500 · Official releases

  • The security patch level advanced to the full 2026-09-01 Pixel level on 10 September. Google's September bulletin, published on 8 September, carries vulnerability details again; that month is covered in Android Security Patch Levels.
  • The Pixel Update Bulletin of 15 September says the cellular modem flaw CVE-2026-58704 may be under targeted exploitation (details in Android Security Patch Levels), with Google's fix in the 2026-09-05 patch level. GrapheneOS release notes up to the 25 September release mention neither 2026-09-05 nor this CVE. The 17 September release backported cellular modem firmware from Android 17 QPR1 and the 25 September release moved the whole hardware support stack to QPR1, but the notes do not say whether either covers this fix. The 2 October release raised the listed patch level to 2026-09-05 (see October 2026).
  • The Dialer gained automatic call recording. The 5 September release shipped it with a per-call opt-out covering both incoming and outgoing calls, and an on-screen notice while recording is active. The 10 September release added an option to record every contact by default with a list of excluded numbers, and declared the microphone and phone foreground service types to fix recording not starting when a call is answered over Bluetooth. From 17 September, anyone turning on automatic recording for the first time gets this exclusion-list mode by default instead of adding contacts one by one. Call recording carries legal constraints in many places, so check the rules where you are before enabling it.
  • Private Space closed two upstream privacy gaps. App drawer search no longer lists apps inside a locked Private Space, something the Pixel Launcher avoids only because it delegates search to Android System Intelligence. Settings also gained a warning that Android's built-in option for hiding a Private Space is superficial and has several known detection tricks. Anyone treating a Private Space as genuinely hidden should reassess.
  • The 17 September release added clipboard read restrictions, set per app or as a global default. With it on, an app cannot read the clipboard by itself; pasting goes through the system selection toolbar, the keyboard, keyboard shortcuts or accessibility services, so the user always initiates it. Clipboards often hold passwords and one-time codes, and this keeps background apps away from them. Blocked reads trigger a notice, and on 19 September the minimum interval between repeats of that notice dropped from one minute to six seconds; anyone who finds it noisy can switch the notice off per app. The 25 September release improved the settings interface for this feature. The bundled keyboard also gained a paste chip that offers recently copied content.
  • hardened_malloc (the hardened memory allocator GrapheneOS maintains) switched to MADV_DONTNEED_LOCKED for better mlockall compatibility, and fixed extreme out-of-memory edge cases where a mapping could be unmapped without its replacement being put in place. The 25 September release added several allocation performance optimisations.
  • The system file manager (DocumentsUI) no longer strips location metadata from copies and certain moves. That was an upstream bug that left people believing they had kept a complete original.
  • Vanadium (the hardened Chromium browser bundled with GrapheneOS) shipped four updates up to the 5 September release, tracking the Chromium 152 series. It moved to the 153 series on 17 September and to the 154 series (154.0.8037.57.1) on 25 September.
  • All three kernel lines (6.1, 6.6, 6.12) moved to the latest GKI LTS revisions. The 6.6 and 6.12 lines also work around an upstream arm64 KVM bug that stops devices booting with lockdown in confidentiality mode. The 17 September release brought the three lines to 6.1.177, 6.6.143 and 6.12.93, and added a 6.18 kernel branch.
  • Pixel cellular modem firmware was backported from Android 17 QPR1 on 17 September, which caused compatibility problems with some carriers. The 19 September release backported the matching CarrierSettings to fix them, and fixed a crash in the Wi-Fi calling component (wfc-pkt-router). The 25 September release added infrastructure for Android 17 to use QPR1 hardware support directly, moving kernel drivers, firmware and userspace hardware support code wholesale to QPR1, and restored the modem carrier override for 6th-generation Pixels that Google had left out.
  • The 25 September release restored the SIM PIN scrambling toggle on the new Protect SIM card screen. With it on, the digits move to different positions each time, so someone watching your fingers cannot read the PIN.
  • On 10th-generation and later Pixels, the 25 September release reclaimed the storage the stock OS reserves for preloaded AI models and gave it back to the user.
  • Device coverage runs from Pixel 6 to Pixel 10a, unchanged this month.

August 2026

Releases 2026080500, 2026081300 · Official releases

  • The security patch level advanced to the full 2026-08-05 Pixel level, alongside August's Pixel driver and firmware code.
  • The kernel backported the fix for CVE-2026-64560. Tails shipped an emergency fix for the same Linux kernel flaw in 7.10.1, where it let an attacker inside Tor Browser gain administrator privileges.
  • Contact Scopes had compatibility problems with WhatsApp and sandboxed Google Play services on Android 17. A workaround shipped on 5 August, replaced by a proper fix on 13 August that runs the filtered query using the calling app's identity.
  • Two vulnerabilities still unfixed upstream were closed on 13 August: both CredentialManager and the Play services FIDO activities were made opaque, so nothing underneath shows through. Fixing upstream issues before Google does is one of the practical differences from stock Android.
  • Vanadium (the hardened Chromium browser bundled with GrapheneOS) shipped four updates during August, tracking the Chromium 151 series.
  • Device coverage runs from Pixel 6 to Pixel 10a, unchanged this month.
  • No release shipped between 13 August and the end of the month, the longest gap in the past four months.

July 2026

Releases 2026070500, 2026071100, 2026071500, 2026072900 · Official releases

  • The listed security patch level moved to 2026-07-05 on 11 July, a level for which neither the Android nor the Pixel bulletin lists additional patches. The same release picked up July's Pixel driver and firmware code.
  • A location privacy flaw inherited from upstream Android was fixed: apps without precise location permission could still read secondary fields such as altitude and accuracy from the coarse location. GrapheneOS now rebuilds coarse locations from an allowlist of fields.
  • Kernel hardware memory tagging caught a double-free in the USB gadget Ethernet driver. Protections GrapheneOS enables by default catching real upstream bugs is a pattern that recurs in later months here.
  • The PIN entry interface used outside the lock screen gained the enhanced privacy treatment, and the 128-digit PIN limit now works in the new interface.
  • Secure (exec) spawning was reimplemented, with the global toggle replaced by a per-app one and noticeably better app compatibility. A follow-up on 15 July handled anti-tampering libraries, so protection schemes like V-KEY are no longer blocked.
  • ContactsProvider and Telephony each got an upstream Android security fix, the latter caused by a missing system permission check for apps targeting API levels below 30.

June 2026

Releases 2026060100 through 2026062800 (eight in total) · Official releases

  • The month Android 17 shipped. The full 2026-06-01 level landed on 1 June, followed on 18 June by the full 2026-06-05 Pixel level released alongside Android 17. One CVE in that batch, CVE-2025-48595, was flagged as possibly under limited, targeted exploitation; see Android security patch levels. What Android 17 means for the position GrapheneOS is in is covered in a separate post.
  • Hardware memory tagging caught three upstream driver bugs this month: a use-after-free (memory handed back and then used again, which can be turned into running attacker code) in the Broadcom Wi-Fi driver, plus two out-of-bounds reads (reading memory it should not, potentially leaking another program's data) in the DisplayPort driver caused by displays that do not follow the DisplayPort specification.
  • Network Location now requires TLSv1.3 for the Apple and Apple China location services as well, matching what GrapheneOS already required of its own service.
  • Android 17 brought several behaviour changes: the Wi-Fi quick tile now actually disables Wi-Fi rather than merely disconnecting from the current network, and Nearby Devices was split to break out local network access, which stays enabled by default for apps not targeting Android 17.
  • Settings again lists the duress password under the screen lock menu, a feature that only gets used if people can find it.