GrapheneOS Release Notes

Tags:

• 2026100600 (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)

Changes since the 2026100200 release:

• full 2026-10-05 security patch level
• Pixels: update to October 2026 firmware and HALs
• fix upstream integer overflow bug in ZipFileRO.cpp causing memory corruption with a 65,535 byte entry name
• use speed compiler filter for all system_server JARs and non-APEX APKs instead of using speed-profile when a profile exists (improves core OS performance)
• Contacts: don't offer local accounts for new labels when default account is cloud
• kernel (6.1): update to latest GKI LTS branch revision
• kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.94
• kernel (6.18): update to latest GKI LTS branch revision
• kernel (6.6, 6.12, 6.18): change approach to disabling Android's vendor hooks for INIT_ON_FREE to avoid conflicts
• Seedvault: migrate to the latest upstream Android 17 branch from our own port to Android 17 to get the latest upstream improvements
• Seedvault: implement downstream fixes for a bunch of bugs and user interface deficiencies …

Tags:

• 2026100200 (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)

Changes since the 2026092500 release:

• kernel (Pixel): restore Android 17 (CP2A) mmap read-ahead behavior to resolve stuttering due to memory pressure caused by an upstream Pixel kernel change in Android 17 QPR1
• disable unprivileged hardware keepalives since it creates a VPN leak
• raise listed security patch level to 2026-09-05 since we've already had the 2026-09-05 Android security patch level for a while and have all the Pixel firmware/driver updates from Android 17 QPR1 since the last release
• kernel (6.1): update to latest GKI LTS branch revision
• kernel (6.6): update to latest GKI LTS branch revision
• kernel (6.12): update to latest GKI LTS branch revision
• kernel (6.18): update to latest GKI LTS branch revision including update to 6.18.33
• fix upstream Android bug causing last modified time being set incorrectly for files restored from Android backups due to it passing seconds to an API taking milliseconds (files had last modified time set to January 1970)
• Messaging: update to version 13 …

Tags:

• 2026092500 (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)

Changes since the 2026091900 release:

• Pixels: fully update kernel drivers, firmware and userspace hardware support code to Android 17 QPR1 by adding infrastructure to support it on Android 17
• add back SIM PIN scrambling toggle in the new Protect SIM card screen
• Settings: improve user interface for the secure paste feature controlling clipboard access
• adevtool: restore the Cape modem carrier override for 6th generation Pixels since Google didn't include it
• adevtool: reclaim storage space reserved for preloaded AI models used by the stock Pixel OS on 10th/11th gen Pixels
• bionic libc: add missing stack size calculation overflow check (no real world impact)
• bionic libc: revert legacy change removing VLA due to -fstack-clash-protection making it safe for a while now (fixes an issue with Bionic trace markers)
• Sandboxed Google Play: add CLOEXEC to zip file descriptors created with dup for sandboxed Google Play services dynamite modules in ART, bionic and libcore (no real world impact) …

Tags:

• 2026091900 (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)

Changes since the 2026091700 release:

• Pixels: backport CarrierSettings from Android 17 QPR1 to resolve carrier compatibility issues caused by the modem firmware backport
• Pixels: backport wfc-pkt-router from Android 17 QPR1 to resolve a crash
• reduce rate limit for notifying about clipboard reads blocked by our secure paste feature from 1 minute to 6 seconds since users can toggle off the notice on a per-app basis if it's an annoyance
• Vanadium: update to version 153.0.8010.52.0

All of the Android 17 security patches from the current October 2026, November 2026, December 2026, January 2027, February 2027 and March 2027 Android Security Bulletins are included in the 2026091901 security preview release. List of additional fixed CVEs:

• Critical: CVE-2026-55265, CVE-2026-58814, CVE-2026-58865, CVE-2026-58868, CVE-2026-58876, CVE-2026-58880, CVE-2026-58882, CVE-2026-58984 …

Tags:

• 2026091700 (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)

Changes since the 2026091000 release:

• Pixels: backport cellular modem firmware from Android 17 QPR1
• add per-app toggle for disallowing apps reading the clipboard with a global toggle to make it the default (forces pasting via the OS selection toolbar, keyboard apps, keyboard shortcuts or accessibility services)
• Keyboard: add paste chip to offer pasting recently copied content when there's nothing else to show as an option
• Dialer: default to the contact opt-out mode for users enabling automatic call recording for the first time rather than opt-in
• update timezone data to 2026c
• kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.177
• kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.143
• kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.93
• add 6.18 kernel branch
• Vanadium: update to version 153.0.8010.47.0
• adevtool: improve the process-bulletin-patches command …

Tags:

• 2026091000 (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)

Changes since the 2026090700 release:

• full 2026-09-01 security patch level
• Contact Scopes: improve compatibility with certain apps
• Dialer: add the option to enable call recording for every contact by default with a list of excluded numbers
• Dialer: declare microphone and phone foreground service type to fix automatic call recording for answering calls via Bluetooth
• SystemUI: respect lockscreen media setting on always-on display
• kernel (6.1): update to latest GKI LTS branch revision
• kernel (6.6): update to latest GKI LTS branch revision
• kernel (6.12): update to latest GKI LTS branch revision
• GmsCompatConfig: update to version 174
• Vanadium: update to version 153.0.8010.36.0
• adevtool: improve the apply-bulletin-patches command and rename it to process-bulletin-patches …

Tags:

• 2026090700 (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)

Changes since the 2026090500 release:

• dismiss app drawer keyboard before private space unlock to fix private space search credential prompt text disappearing on secondary users
• hardened_malloc: update libdivide to 5.4.0

All of the Android 17 security patches from the current September 2026, October 2026, November 2026, December 2026, January 2027, February 2027 and March 2027 Android Security Bulletins are included in the 2026090701 security preview release. List of additional fixed CVEs:

• Critical: CVE-2026-28591, CVE-2026-28604, CVE-2026-28639, CVE-2026-28653, CVE-2026-28662, CVE-2026-28666, CVE-2026-45515, CVE-2026-45531, CVE-2026-49879, CVE-2026-49882, CVE-2026-49884, CVE-2026-49918, CVE-2026-49921, CVE-2026-49926, CVE-2026-49927, CVE-2026-49932, CVE-2026-49933, CVE-2026-55256, CVE-2026-55265, CVE-2026-55268, CVE-2026-55269, CVE-2026-55273, CVE-2026-55277, CVE-2026-55280, CVE-2026-58814, CVE-2026-58820, CVE-2026-58823, CVE-2026-58835, CVE-2026-58865, CVE-2026-58868, CVE-2026-58876, CVE-2026-58880, CVE-2026-58882, CVE-2026-58984 …

Tags:

• 2026090500 (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)

Changes since the 2026081300 release:

• Launcher: filter Private Space apps from search while it's locked to resolve upstream privacy deficiency (Pixel Launcher delegates search to Android System Intelligence which fixed this already)
• Launcher: add "Private Space" action for unlocking the Private Space to app drawer search to match the Pixel Launcher
• Launcher: fix upstream crash on large-screen devices when opening a folder from the taskbar with 3-button navigation
• Settings: add warning about the standard Android feature for hiding Private Spaces only being superficial and having multiple known tricks for detecting it
• Dialer: add support for automatic call recording with a per-call opt-out switch for both incoming and outgoing calls along with a notice of automatic call recording being active during calls
• backport upstream Android 17 QPR1 Beta 5 fix for widgets disappearing after reboot
• exempt DocumentsUI from redaction of location metadata to resolve upstream bug causing the system file manager to redact location metadata for copies or certain moves …

Tags:

• 2026081300 (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)

Changes since the 2026080500 release:

• Bluetooth: handle nested secondary profiles when sending broadcasts to fix support for wireless Android Auto in nested secondary profiles (Private Spaces and work profiles)
• enable multiuser-unaware API usage warnings for Bluetooth processes
• Contact Scopes: use identity of the calling app for the filtered query since the query validation, projection mapping, etc. depend on the target SDK version of the calling app (this is a proper solution to the Contact Scopes compatibility issues for WhatsApp and sandboxed Google Play services in Android 17 replacing our previous workaround)
• CredentialManager: make CredentialSelectorActivity opaque (avoid showing activity underneath) to resolve security vulnerabilities not yet fixed upstream
• Sandboxed Google Play compatibility layer: mark all Play services FIDO activities as opaque (avoid showing activity underneath) to resolve Play services security vulnerabilities not yet fixed upstream …

Tags:

• 2026080500 (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)

Changes since the 2026072900 release:

• full 2026-08-05 Pixel security patch level
• update to August 2026 Pixel driver/firmware code
• kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): apply fix for CVE-2026-0163
• Contact Scopes: add a workaround for WhatsApp ACCOUNT_TYPE queries to resolve an incompatibility introduced with Android 17
• Sandboxed Google Play compatibility layer: retain RPC provider connection for out-of-memory adjustment
• backport Android 17 QPR1 fix for Bluetooth developer options confirmation
• kernel (6.1, 6.6, 6.12): backport patch for CVE-2026-64560
• kernel (6.1): update to latest GKI LTS branch revision
• kernel (6.6): update to latest GKI LTS branch revision
• kernel (6.12): update to latest GKI LTS branch revision
• Vanadium: update to version 151.0.7922.71.0
• Camera: update to version 91
• Camera: update to version 92 …

Tags:

• 2026072900 (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)

Changes since the 2026071500 release:

• extend per-app opt-out for hardened_malloc and extended virtual address space to child processes to support working around rare app compatibility issues involving separate native processes run by an app
• override previous SELinux context for secure (exec) spawning to fix compatibility with anti-tampering libraries checking for it
• ContactsProvider: fix upstream Android security vulnerability
• Telephony: fix upstream Android security vulnerability caused by missing system permission check for apps with API levels below 30
• adevtool: include feature flags for Pixel NFC/eSE/eSIM firmware updater to avoid deviating from the stock OS
• work around upstream bug for original-package renaming to resolve crashes with Vanadium on OS installs from 4-5 years ago when using the native zygote (we had to temporarily turn off javaless renderers in Vanadium Config 192 and will re-enable it after this OS release)
• libpng: backport upstream security patches
• kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.175 …

Tags:

• 2026071500 (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)

Changes since the 2026071100 release:

• Secure (exec) spawning: skip vkey.android.vos.VosZygotePreload to make exec-based spawning compatible with apps using V-KEY V-OS Mobile App Protection
• Secure (exec) spawning: skip redundant mount namespace setup for compatibility with anti-tampering code checking Linux mount IDs
• start compat zygote at boot instead of on-demand for compatibility with anti-tampering code checking Linux mount IDs (compat zygote is only used when both secure spawning and hardened_malloc are disabled for an app)
• use lazy preloading for compat zygote to reduce memory usage when it's not used (it's only used for app processes which disable both hardened_malloc and secure spawning)
• install CarrierConfig2 in all profiles to avoid using default carrier configuration values in secondary users
• notify when Wi-Fi hotspot is disabled due to user change (since users have separate Wi-Fi settings since Android 17) to provide a shortcut for turning it back on via the notification …

Tags:

• 2026071100 (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)

Changes since the 2026070500 release:

• replace secure (exec) spawning feature with a new implementation with improved app compatibility and a per-app toggle replacing the previous global toggle
• extend exec spawning feature to the native zygote added in Android 17
• raise listed security patch level to 2026-07-05 security patch level which has no additional patches listed in either the Android or Pixel bulletin
• update to July 2026 Pixel driver/firmware code
• fix upstream bug in multi-user handling for the WifiService package state listener which among other possible issues was causing wireless Android Auto compatibility issues in secondary users
• fix upstream bug in RemoteException handling for GeocodeProviderBase causing exceptions between the geocoding service and client app to crash the geocoding service
• fix external display mirroring in secondary users (upstream bug)
• fix handling of multiple users for screen recording (upstream bug) …

Users solely doing offline updates via recovery mode sideloading need a special sideload-only release to update from Android 16 QPR2 to Android 17. This release fixes upstream bugs for sideloading present in Android 16 QPR2 which prevented updating to Android 17 unless the OS images were far larger than the GrapheneOS ones which triggers a fallback path avoiding the issue.

Tags:

• 2026070500 (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)

Changes since the 2026062800 release:

• rebuild coarse locations from allowlisted fields to resolve an upstream Android privacy flaw leaking secondary fields such as altitude and accuracy to apps without precise location granted
• System UI:: run scroll capture tile handling on main thread to fix an upstream race condition causing memory corruption
• Launcher: fix removing space for the quick search bar to avoid removing padding at the bottom
• fix PIN scrambling for Private Spaces configured to use parent credentials …

Tags:

• 2026062800 (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)

Changes since the 2026062300 release:

• add setting for controlling Certificate Transparency (CT) log list downloads used for apps enforcing CT which is enabled by default for apps targeting Android 17+ with a choice between GrapheneOS (default), Standard (previous behavior) and Off
• enable register_bluetooth_receiver_for_all_users feature flag to fix Bluetooth telecom functionality in secondary users (resolves an upstream regression in Android 17)
• temporarily use absolute media profile XML paths to work around an exec-based spawning compatibility issue breaking WhatsApp functionality which will be properly addressed by our upcoming overhaul to exec-based spawning
• add native zygote support to handle Chrome using it and for future use in Vanadium once exec spawning is ported to it
• build wpa_supplicant_mainline from source since it's used instead of the vendor wpa_supplicant on the Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL and Pixel 10 Pro Fold
• fix NFC quick tile state not updating in secondary users …

Tags:

• 2026062300 (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)

Changes since the 2026062200 release:

• fix serious upstream Android VPN race condition resulting in the always-on VPN being disabled in edge cases including VPN app updates
• fix Bluetooth auto-off in secondary users for Android 17
• Sandboxed Google Play compatibility layer: resolve ThermalManagerService droidguard incompatibility causing RCS to break after droidguard is updated
• Sandboxed Google Play compatibility layer: increase log level of maybeInterceptBinderProxyDump() to help with debugging droidguard checks

All of the Android 17 security patches from the current July 2026, August 2026, September 2026, October 2026, November 2026 and December 2026 Android Security Bulletins are included in the 2026062301 security preview release. List of additional fixed CVEs:

• Critical: CVE-2026-28591, CVE-2026-28604, CVE-2026-28639, CVE-2026-28662, CVE-2026-28666, CVE-2026-45515, CVE-2026-45531, CVE-2026-49879, CVE-2026-49882, CVE-2026-49884 …

Tags:

• 2026062200 (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)

Changes since the 2026062100 release:

• change the behavior of pressing the new Android 17 Wi-Fi quick tile to disabling Wi-Fi instead of only pausing it by disconnecting from the current network and not actively connecting to another automatically
• backport upstream fix for recovery mode sideloading to replace the workaround we included in our initial public Android 17 release (this will needed to be backported to Android 16 QPR2 to provide a sideload upgrade path)
• Sandboxed Google Play compatibility layer: add local network access to the permissions added by the wireless Android Auto toggle since it's often required
• Sandboxed Google Play compatibility layer: add stub for NsdManager.registerService() to handle lack of ACCESS_LOCAL_NETWORK
• enable photopicker in Wallpaper Picker app to restore photo picker functionality from before Android 17
• Wallpaper Picker: add vertical padding to the "Choose a photo" button
• Launcher: fix hidden workspace app labels on non-responsive grids …

Tags:

• 2026062100 (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)

Changes since the 2026061800 release:

• disable MTE for Widevine Rikers service since it's incompatible with it (issue predates Android 17)
• Sandboxed Google Play compatibility layer: avoid opening extra file descriptions to obtain Play services data prefix paths to avoid a compatibility issue with anti-tampering code used by the Kia Connect app and likely others (issue predates Android 17)
• separate GrapheneOS framework resource IDs from AOSP resource IDs to avoid incompatibilities with Pixel vendor components (issue predates Android 17)
• kernel (Pixel 10): fix for an upstream Broadcom Wi-Fi bcm4383 driver memory corruption bug to avoid invalid memory accesses caught by the kernel hardware memory tagging enabled by GrapheneOS
• disable UBLK feature flag for over-the-air updates due to it likely causing update reliability issues for devices with support for it (6.6 kernel or newer)
• disable UBLK for generated over-the-air update packages to force disable it for updates from the initial Android 17 release …

This is the initial release of GrapheneOS based on Android 17.

Tags:

• 2026061800 (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)

Changes since the 2026061600 release:

• full 2026-06-05 Pixel security patch level (released with Android 17)
• rebased onto CP2A.260605.016 Android Open Source Project release (Android 17)
• add workaround for upstream bug breaking using recovery mode sideloading for updating to Android 17 releases
• revert in-process Opus codec sandboxed with LFI (Lightweight Fault Isolation) to dedicated sandboxed process in order to restore compatibility with hardware memory tagging and avoid likely holes in LFI
• Sandboxed Google Play compatibility layer: add stubs for BluetoothLeBroadcast methods
• Vanadium: update to version 149.0.7827.159.0

All of the Android 17 security patches from the current July 2026, August 2026, September 2026, October 2026, November 2026 and December 2026 Android Security Bulletins are included in the 2026061801 security preview release. List of additional fixed CVEs: …

This is our final release based on Android 16 QPR2/QPR3 since we've completed our initial port to Android 17 and are resolving regressions to prepare it for a public release very soon.

Tags:

• 2026061600 (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)

Changes since the 2026060600 release:

• skip replacing pairip Play Store installer check with Play Store source stamp checks for apps installed directly from the Play Store where the check will pass to avoid causing compatibility issues for apps with deeper pairip integration
• hardened_malloc: add support for Cuttlefish build targets
• Network Location: require TLSv1.3 for Apple and Apple China location services in addition to the GrapheneOS service
• kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.174
• kernel (6.6): update to latest GKI LTS branch revision
• kernel (6.12): update to latest GKI LTS branch revision
• Vanadium: update to version 149.0.7827.102.0
• Vanadium: update to version 149.0.7827.114.0 …