Open source privacy and security focused mobile OS with Android app compatibility. Forum, Discord and Matrix: https://xitter.cf/t.co/C0RaJbZosj
Joined March 2019
- Tweets44.5K
- Following0
- Followers146K
- Likes12.5K
Pinned Tweet
We're happy to announce a long-term partnership with Motorola. We're collaborating on future devices meeting our privacy and security standards with official GrapheneOS support.
motorolanews.com/motorola-th…
Our discussion forum is the only software we have using PHP. We've taken it down temporarily while waiting for the patches for php.net/archive/2026.php#202… due to vulnerability details already being available and proof of concept exploits being developed. Don't want to take the risk.
Details are public and exploits are being written. Too risky to keep the forum up. It's the 1st major downtime for it.
From a PHP core developer:
phpc.social/@Girgias/1174764…
> The only thing I can say is that the only mitigation is patching / upgrading PHP. I sadly know too much.
Our discussion forum is updated to PHP 8.5.12 and has been available again for over an hour:
discuss.grapheneos.org/
Vanadium version 156.0.8078.47.0 released:
github.com/GrapheneOS/Vanadi…
See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog.
Forum discussion thread:
discuss.grapheneos.org/d/429…
#GrapheneOS #privacy #security #browser
GmsCompatConfig version 177 released:
github.com/GrapheneOS/platfo…
See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog.
Forum discussion thread:
discuss.grapheneos.org/d/429…
#GrapheneOS #privacy #security #gmscompat
This is the new GrapheneOS boot animation. It's generated frame-by-frame using a script. It has a minimum 3.5s total runtime for the intro including a small pause. The rest of the animation gets interrupted once the device is booted to avoid any delay so there can't be an outro.
The animation included in 2026101600 holds the logo for 0.8s rather than 2.0s in the video above since the new zips weren't committed to the OS yet. We've reduced that to 1.6s though.
For the Pixel Tablet, we've reduced the size of the logo to 30% of the screen height from 40%.
The acceleration throughout the animation is currently done with smootherstep (quintic smoothstep) which is working nicely and likely going to be kept.
en.wikipedia.org/wiki/Smooth…
The top speed for the loop could be reduced but we're getting mixed feedback about that aspect of it.
GrapheneOS version 2026101600 released:
grapheneos.org/releases#2026…
See the linked release notes for a summary of the improvements over the previous release.
Forum discussion thread:
discuss.grapheneos.org/d/428…
#GrapheneOS #privacy #security
Yahoo is still blocking emails from our newly assigned IPv4 space (206.220.120.0/22). It's likely they're behind on updating their database of allocated IP space. It was already published via arin.net/resources/guide/ipv… and other providers have been accepting it for 2 weeks already.
We'd appreciate if someone working at Yahoo could get it resolved. We're going to continue using our new IPv4 space for email since it works with Google, Microsoft, Proton and hundreds of other mail providers. We'll just block yahoo.com registrations on our forum.
Vanadium version 155.0.8059.84.0 released:
github.com/GrapheneOS/Vanadi…
See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog.
Forum discussion thread:
discuss.grapheneos.org/d/428…
#GrapheneOS #privacy #security #browser
GrapheneOS retweeted
No. The opposite: make all firmware images public. They can be dumped anyway. Your best bet is getting more eyes on them.
Open source everything, the code is not a moat. Obfuscation is even dumber today.
Vanadium version 155.0.8059.79.0 released:
github.com/GrapheneOS/Vanadi…
See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog.
Forum discussion thread:
discuss.grapheneos.org/d/428…
#GrapheneOS #privacy #security #browser
Vanadium version 155.0.8059.39.0 released:
github.com/grapheneos/Vanadi…
See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog.
Forum discussion thread:
discuss.grapheneos.org/d/426…
#GrapheneOS #privacy #security #browser
GrapheneOS version 2026100600 released:
grapheneos.org/releases#2026…
See the linked release notes for a summary of the improvements over the previous release.
Forum discussion thread:
discuss.grapheneos.org/d/426…
#GrapheneOS #privacy #security
GmsCompatConfig version 176 released:
github.com/GrapheneOS/platfo…
See the linked release notes for a summary of the improvements over the previous release and a link to the full changelog.
Forum discussion thread:
discuss.grapheneos.org/d/425…
#GrapheneOS #privacy #security #gmscompat
Android Security Bulletins have been twisted into a way to mislead the public about security. Patches are only listed in the bulletins 2-6 months after they're disclosed to each Android OEM and allowed to be shipped. Patches listed in the September 2026 bulletin were available to ship for months.
Android Security Bulletins are divided into two sections. The first section contains High and Critical severity Android Open Source Project (AOSP) patches backported to older releases. For years already, Low and Moderate severity AOSP patches have required updating to the latest major releases.
The first section is the main portion of the patches and gets provided 2-6 months in advance as security preview patches. The security preview patches are allowed to be shipped right away, which is sensible. The horrific part is delaying disclosure of the vulnerabilities and patches for months.
The security preview patches aren't only for Android projects but rather also include patches to external projects. Some of these external patches are already publicly disclosed while others are not. As one example, there have been non-publicly-disclosed security preview patches for wpa_supplicant.
GrapheneOS provides security preview releases providing early access to all of the security preview patches. It's the only OS quickly shipping all of these patches. A subset of these patches are shipped early by the stock OS on Pixels and Samsung flagships but far from all and it comes weeks later.
In 2026, Google has been completely overwhelmed by the volume of vulnerabilities being discovered by AI models both internally and externally. They recently announced to OEMs that the full set of High and Critical severity patches will only be available through the latest yearly and QPR2 releases.
Their announcement explains the massive number of vulnerabilities discovered by AI models internally will only be patched in the latest major releases. A subset deemed to pose an imminent risk to users will be backported to the most recent releases but not to older releases with security support.
Each Android Security Bulletin also has a 2nd section with listing an extraordinarily small subset of the vulnerabilities patched in the upstream Linux kernel along with a small subset of vulnerabilities patched in drivers/firmware shared by many devices. This is deliberate to keep the bar very low.
Google wants Android users to feel safe due to believing they have the latest privacy and security patches. Therefore, they delay patches being listed in the bulletins for months and don't list a substantial portion of Linux, driver and firmware patches. It's a very low bar so devices can keep up.