GrapheneOS Release Notes

Name: GrapheneOS
Brand: GrapheneOS

Follow GrapheneOS to add their release notes to your feed!

37 release notes curated from 1 source by the Releasebot Team. Last updated: Oct 18, 2026

Get this feed:

Oct 16, 2026
Date parsed from source:
Oct 16, 2026

First seen by Releasebot:
Oct 18, 2026
GrapheneOS

2026101600

GrapheneOS releases a security preview with Android 17 patches and fixes for numerous vulnerabilities, alongside updates to Sandboxed Google Play, connectivity settings, sensor permissions, Vanadium, and boot animations for foldable displays.
Tags:

Changes since the 2026100600 release:

All of the Android 17 security patches from the current November 2026, December 2026, January 2027, February 2027, March 2027 and April 2027 Android Security Bulletins are included in the 2026101600 security preview release. List of additional fixed CVEs:

For detailed information on security preview releases, see our .post about it

(Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)2026101600

Sandboxed Google Play: switch from RpcProvider to service bindings and broadcasts to handle new versions of Play services

Sandboxed Google Play: improve handling of Play Store install confirmation dialogs

Launcher: update configurations and resources to match Pixel Launcher

expand Sensors permission to custom sensor types added by devices which includes temperature, pressure and proximity sensors for Pixels in practice

WindowManagerService: fix upstream Android vulnerability from PID and UID parameter mixup

Settings: show adaptive connectivity setting for controlling the default enabled connectivity heuristics

prevent resuming activities hidden by keyguard after an activity finishes to resolve an upstream security weakness

adevtool: fix NFC/eSE/eSIM firmware updates on 9th generation Pixels (this issue started with the October 2026 update and earlier firmware versions applied fine without this)

add back disabling of preloading graphics driver for secure (exec) spawning

new GrapheneOS boot animation

enable multi-display boot animation feature to display it on the outer display of folding devices too

fix upstream bug resulting in the boot animation on the outer display of folding devices stalling due to display configuration in the late boot process (this is likely why AOSP and the stock Pixel OS still don't display a boot animation on the outer display)

Pixels: update to October 2026 kernel drivers which is delayed due to ongoing lack of GPLv2 compliance by Google (none of the security patches listed in the October 2026 Pixel Update Bulletin are in the kernel drivers for 6th through 10th gen Pixels)

kernel (6.1): update to latest GKI LTS branch revision

kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.96

kernel (6.18): update to latest GKI LTS branch revision

update timezone data to 2026e

Vanadium: update to version 155.0.8059.39.0

Vanadium: update to version 155.0.8059.79.0

Vanadium: update to version 155.0.8059.84.0

TalkBack: switch to standalone app signing key

fix benign CtsWindowManagerDeviceKeyguard:KeyguardLockedTests test failures caused by the 2nd factor PIN entry being focusable during creation of the user interface

Critical

CVE-2026-58814, CVE-2026-58820, CVE-2026-58868, CVE-2026-58876, CVE-2026-58882, CVE-2026-58984, CVE-2026-59069

High

CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2026-0053, CVE-2026-28619, CVE-2026-28635, CVE-2026-28643, CVE-2026-28645, CVE-2026-45522, CVE-2026-45523, CVE-2026-47964, CVE-2026-49914, CVE-2026-49935, CVE-2026-55260, CVE-2026-55272, CVE-2026-55274, CVE-2026-55284, CVE-2026-58860, CVE-2026-58866, CVE-2026-58867, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58883, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58935, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58956, CVE-2026-58957, CVE-2026-58958, CVE-2026-58960, CVE-2026-58961, CVE-2026-58962, CVE-2026-58963, CVE-2026-58964, CVE-2026-58965, CVE-2026-58966, CVE-2026-58968, CVE-2026-58969, CVE-2026-58970, CVE-2026-58971, CVE-2026-58972, CVE-2026-58973, CVE-2026-58974, CVE-2026-58975, CVE-2026-58976, CVE-2026-58978, CVE-2026-58979, CVE-2026-58985, CVE-2026-58986, CVE-2026-58988, CVE-2026-58990, CVE-2026-58993, CVE-2026-58994, CVE-2026-58995, CVE-2026-58997, CVE-2026-58998, CVE-2026-59000, CVE-2026-59001, CVE-2026-59002, CVE-2026-59003, CVE-2026-59004, CVE-2026-59005, CVE-2026-59006, CVE-2026-59007, CVE-2026-59008, CVE-2026-59011, CVE-2026-59013, CVE-2026-59014, CVE-2026-59015, CVE-2026-59016, CVE-2026-59017, CVE-2026-59020, CVE-2026-59021, CVE-2026-59022, CVE-2026-59023, CVE-2026-59028, CVE-2026-59031, CVE-2026-59032, CVE-2026-59034, CVE-2026-59049, CVE-2026-59050, CVE-2026-59051, CVE-2026-59052, CVE-2026-59053, CVE-2026-59054, CVE-2026-59056, CVE-2026-59057, CVE-2026-59058, CVE-2026-59059, CVE-2026-59063, CVE-2026-59064, CVE-2026-59065, CVE-2026-59067, CVE-2026-59068, CVE-2026-59070, CVE-2026-59071, CVE-2026-104154, CVE-2026-104155, CVE-2026-104156, CVE-2026-104159, CVE-2026-104160, CVE-2026-104161, CVE-2026-104162, CVE-2026-104163, CVE-2026-104164, CVE-2026-104166, CVE-2026-104167, CVE-2027-0002, CVE-2027-0010, CVE-2027-0011, CVE-2027-0012
Original source
Oct 6, 2026
Date parsed from source:
Oct 6, 2026

First seen by Releasebot:
Oct 7, 2026
GrapheneOS

2026100600

GrapheneOS ships October 2026 security preview with Android 17 patches, updated Pixel firmware and HALs, kernel updates, Seedvault improvements, Vanadium 154, and GmsCompatConfig 176, plus a core OS performance boost and broad CVE fixes.
Tags:

Changes since the 2026100200 release:

All of the Android 17 security patches from the current November 2026, December 2026, January 2027, February 2027, March 2027 and April 2027 Android Security Bulletins are included in the 2026100601 security preview release. List of additional fixed CVEs:

For detailed information on security preview releases, see our .post about it

(Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)2026100600

full 2026-10-05 security patch level

Pixels: update to October 2026 firmware and HALs

fix upstream integer overflow bug in ZipFileRO.cpp causing memory corruption with a 65,535 byte entry name

use speed compiler filter for all system_server JARs and non-APEX APKs instead of using speed-profile when a profile exists (improves core OS performance)

Contacts: don't offer local accounts for new labels when default account is cloud

kernel (6.1): update to latest GKI LTS branch revision

kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.94

kernel (6.18): update to latest GKI LTS branch revision

kernel (6.6, 6.12, 6.18): change approach to disabling Android's vendor hooks for INIT_ON_FREE to avoid conflicts

Seedvault: migrate to the latest upstream Android 17 branch from our own port to Android 17 to get the latest upstream improvements

Seedvault: implement downstream fixes for a bunch of bugs and user interface deficiencies

Vanadium: update to version 154.0.8037.126.0

GmsCompatConfig: update to version 176

Critical:

CVE-2026-58814, CVE-2026-58820, CVE-2026-58868, CVE-2026-58876, CVE-2026-58882, CVE-2026-58984, CVE-2026-59062, CVE-2026-59069

High:

CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2026-0053, CVE-2026-28619, CVE-2026-28635, CVE-2026-28643, CVE-2026-28645, CVE-2026-45522, CVE-2026-45523, CVE-2026-47964, CVE-2026-49914, CVE-2026-49935, CVE-2026-55260, CVE-2026-55272, CVE-2026-55274, CVE-2026-55284, CVE-2026-58860, CVE-2026-58866, CVE-2026-58867, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58883, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58935, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58956, CVE-2026-58957, CVE-2026-58958, CVE-2026-58960, CVE-2026-58961, CVE-2026-58962, CVE-2026-58963, CVE-2026-58964, CVE-2026-58965, CVE-2026-58966, CVE-2026-58968, CVE-2026-58969, CVE-2026-58970, CVE-2026-58971, CVE-2026-58972, CVE-2026-58973, CVE-2026-58974, CVE-2026-58975, CVE-2026-58976, CVE-2026-58978, CVE-2026-58979, CVE-2026-58985, CVE-2026-58986, CVE-2026-58988, CVE-2026-58990, CVE-2026-58993, CVE-2026-58994, CVE-2026-58995, CVE-2026-58997, CVE-2026-58998, CVE-2026-59000, CVE-2026-59001, CVE-2026-59002, CVE-2026-59003, CVE-2026-59004, CVE-2026-59005, CVE-2026-59006, CVE-2026-59007, CVE-2026-59008, CVE-2026-59011, CVE-2026-59013, CVE-2026-59014, CVE-2026-59015, CVE-2026-59016, CVE-2026-59017, CVE-2026-59020, CVE-2026-59021, CVE-2026-59022, CVE-2026-59023, CVE-2026-59028, CVE-2026-59031, CVE-2026-59032, CVE-2026-59034, CVE-2026-59049, CVE-2026-59050, CVE-2026-59051, CVE-2026-59054, CVE-2026-59055, CVE-2026-59056, CVE-2026-59057, CVE-2026-59058, CVE-2026-59059, CVE-2026-59063, CVE-2026-59064, CVE-2026-59065, CVE-2026-59066, CVE-2026-59067, CVE-2026-59068, CVE-2026-59070, CVE-2026-59071

Original source
All of your release notes in one feed

Join Releasebot and get updates from GrapheneOS and hundreds of other software products.

Create account
Get updates with:
Oct 2, 2026
Date parsed from source:
Oct 2, 2026

First seen by Releasebot:
Oct 3, 2026
GrapheneOS

2026100200

GrapheneOS ships a security preview with Android 17 patches from October 2026 through April 2027, kernel updates, a VPN leak fix, better mmap read-ahead to reduce stuttering, and updates to Messaging and Vanadium.

Tags

Changes since the 2026092500 release

All of the Android 17 security patches from the current October 2026, November 2026, December 2026, January 2027, February 2027, March 2027 and April 2027 Android Security Bulletins are included in the 2026100201 security preview release. List of additional fixed CVEs:

For detailed information on security preview releases, see our .post about it

(Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)2026100200

kernel (Pixel): restore Android 17 (CP2A) mmap read-ahead behavior to resolve stuttering due to memory pressure caused by an upstream Pixel kernel change in Android 17 QPR1
disable unprivileged hardware keepalives since it creates a VPN leak
raise listed security patch level to 2026-09-05 since we've already had the 2026-09-05 Android security patch level for a while and have all the Pixel firmware/driver updates from Android 17 QPR1 since the last release
kernel (6.1): update to latest GKI LTS branch revision
kernel (6.6): update to latest GKI LTS branch revision
kernel (6.12): update to latest GKI LTS branch revision
kernel (6.18): update to latest GKI LTS branch revision including update to 6.18.33
fix last modified time being set incorrectly for files restored from Android backups due to it passing seconds to an API taking milliseconds (files had last modified time set to January 1970)
Messaging: update to version 13
Messaging: update to version 14
Messaging: update to version 15
Messaging: update to version 16
Vanadium: update to version 154.0.8037.92.0
adevtool: add command for processing Pixel kernel tarballs
arcslib: add support for system_ext overlays
apksig: handle APKs that lack a V3 signature in print-certs command
add ColdFileReadBenchmark to benchmark cold mmap reads with low free swap

Critical: CVE-2026-55265, CVE-2026-58814, CVE-2026-58820, CVE-2026-58865, CVE-2026-58868, CVE-2026-58876, CVE-2026-58880, CVE-2026-58882, CVE-2026-58984, CVE-2026-59062

High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2026-0053, CVE-2026-28619, CVE-2026-28635, CVE-2026-28643, CVE-2026-28645, CVE-2026-45522, CVE-2026-45523, CVE-2026-47964, CVE-2026-49914, CVE-2026-49935, CVE-2026-55260, CVE-2026-55272, CVE-2026-55274, CVE-2026-55284, CVE-2026-55286, CVE-2026-58860, CVE-2026-58866, CVE-2026-58867, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58883, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58935, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58956, CVE-2026-58957, CVE-2026-58958, CVE-2026-58960, CVE-2026-58961, CVE-2026-58962, CVE-2026-58963, CVE-2026-58964, CVE-2026-58965, CVE-2026-58966, CVE-2026-58968, CVE-2026-58969, CVE-2026-58970, CVE-2026-58971, CVE-2026-58972, CVE-2026-58973, CVE-2026-58974, CVE-2026-58975, CVE-2026-58976, CVE-2026-58978, CVE-2026-58979, CVE-2026-58985, CVE-2026-58986, CVE-2026-58988, CVE-2026-58990, CVE-2026-58993, CVE-2026-58994, CVE-2026-58995, CVE-2026-58998, CVE-2026-59000, CVE-2026-59001, CVE-2026-59002, CVE-2026-59003, CVE-2026-59004, CVE-2026-59005, CVE-2026-59006, CVE-2026-59007, CVE-2026-59008, CVE-2026-59011, CVE-2026-59013, CVE-2026-59014, CVE-2026-59015, CVE-2026-59016, CVE-2026-59017, CVE-2026-59020, CVE-2026-59021, CVE-2026-59022, CVE-2026-59023, CVE-2026-59028, CVE-2026-59031, CVE-2026-59032, CVE-2026-59034, CVE-2026-59049, CVE-2026-59050, CVE-2026-59051, CVE-2026-59054, CVE-2026-59055, CVE-2026-59056, CVE-2026-59059, CVE-2026-59063
Original source
Sep 25, 2026
Date parsed from source:
Sep 25, 2026

First seen by Releasebot:
Sep 27, 2026
GrapheneOS

2026092500

GrapheneOS ships a security preview release with Android 17 security patches, Pixel QPR1 support work, SIM PIN scrambling toggle restoration, secure paste UI improvements, Vanadium and GmsCompatConfig updates, and multiple kernel and hardening fixes.

Tags:

Changes since the 2026091900 release:

All of the Android 17 security patches from the current October 2026, November 2026, December 2026, January 2027, February 2027 and March 2027 Android Security Bulletins are included in the 2026092501 security preview release. List of additional fixed CVEs:

For detailed information on security preview releases, see our .post about it

(Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)2026092500

Pixels: fully update kernel drivers, firmware and userspace hardware support code to Android 17 QPR1 by adding infrastructure to support it on Android 17
add back SIM PIN scrambling toggle in the new Protect SIM card screen
Settings: improve user interface for the secure paste feature controlling clipboard access
adevtool: restore the Cape modem carrier override for 6th generation Pixels since Google didn't include it
adevtool: reclaim storage space reserved for preloaded AI models used by the stock Pixel OS on 10th/11th gen Pixels
bionic libc: add missing stack size calculation overflow check (no real world impact)
bionic libc: revert legacy change removing VLA due to -fstack-clash-protection making it safe for a while now (fixes an issue with Bionic trace markers)
Sandboxed Google Play: add CLOEXEC to zip file descriptors created with dup for sandboxed Google Play services dynamite modules in ART, bionic and libcore (no real world impact)
hardened_malloc: optimize slab quarantine indexing by limiting slab quarantine length multipliers to a power of two (both multipliers are set to the default of 1)
hardened_malloc: optimize aligned size class calculation
hardened_malloc: optimize size class struct layout
hardened_malloc: add missing "cc" to clobber list for MTE assembly (bug inherited from LLVM with no real world impact)
GmsCompatConfig: update to version 175
Vanadium: update to version 154.0.8037.57.0
Vanadium: update to version 154.0.8037.57.1
add scripts for automating building kernels and updating the builds included in the OS source tree
Critical: CVE-2026-55265, CVE-2026-58814, CVE-2026-58865, CVE-2026-58868, CVE-2026-58876, CVE-2026-58880, CVE-2026-58882, CVE-2026-58984
High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2026-0053, CVE-2026-28635, CVE-2026-28643, CVE-2026-28645, CVE-2026-45522, CVE-2026-47964, CVE-2026-49914, CVE-2026-49935, CVE-2026-55272, CVE-2026-55274, CVE-2026-55284, CVE-2026-55286, CVE-2026-58866, CVE-2026-58867, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58883, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58935, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58956, CVE-2026-58957, CVE-2026-58958, CVE-2026-58960, CVE-2026-58961, CVE-2026-58962, CVE-2026-58963, CVE-2026-58964, CVE-2026-58965, CVE-2026-58966, CVE-2026-58968, CVE-2026-58969, CVE-2026-58970, CVE-2026-58971, CVE-2026-58972, CVE-2026-58973, CVE-2026-58974, CVE-2026-58975, CVE-2026-58976, CVE-2026-58978, CVE-2026-58979, CVE-2026-58985, CVE-2026-58986, CVE-2026-58988, CVE-2026-58990, CVE-2026-58993, CVE-2026-58994, CVE-2026-58995, CVE-2026-58998, CVE-2026-59000, CVE-2026-59001, CVE-2026-59002, CVE-2026-59003, CVE-2026-59004, CVE-2026-59005, CVE-2026-59006, CVE-2026-59007, CVE-2026-59008, CVE-2026-59011, CVE-2026-59013, CVE-2026-59014, CVE-2026-59015, CVE-2026-59016, CVE-2026-59017, CVE-2026-59020, CVE-2026-59021, CVE-2026-59022, CVE-2026-59023, CVE-2026-59028, CVE-2026-59031, CVE-2026-59032, CVE-2026-59034, CVE-2026-59049, CVE-2026-59050, CVE-2026-59051, CVE-2026-59054, CVE-2026-59055
Original source
Sep 19, 2026
Date parsed from source:
Sep 19, 2026

First seen by Releasebot:
Sep 20, 2026
GrapheneOS

2026091900

GrapheneOS ships a 2026091901 security preview with Android 17 security patches through March 2027, Pixel modem and carrier compatibility fixes, a faster secure paste clipboard notice, and a Vanadium update with broad vulnerability fixes.

Tags

Changes since the 2026091700 release

All of the Android 17 security patches from the current October 2026, November 2026, December 2026, January 2027, February 2027 and March 2027 Android Security Bulletins are included in the 2026091901 security preview release. List of additional fixed CVEs:

For detailed information on security preview releases, see our .post about it

(Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)2026091900

Pixels: backport CarrierSettings from Android 17 QPR1 to resolve carrier compatibility issues caused by the modem firmware backport

Pixels: backport wfc-pkt-router from Android 17 QPR1 to resolve a crash

reduce rate limit for notifying about clipboard reads blocked by our secure paste feature from 1 minute to 6 seconds since users can toggle off the notice on a per-app basis if it's an annoyance

Vanadium: update to version 153.0.8010.52.0

Critical: CVE-2026-55265, CVE-2026-58814, CVE-2026-58865, CVE-2026-58868, CVE-2026-58876, CVE-2026-58880, CVE-2026-58882, CVE-2026-58984

High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2026-0053, CVE-2026-28635, CVE-2026-28643, CVE-2026-28645, CVE-2026-45522, CVE-2026-47964, CVE-2026-49935, CVE-2026-55272, CVE-2026-55274, CVE-2026-55284, CVE-2026-55286, CVE-2026-58866, CVE-2026-58867, CVE-2026-58868, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58883, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58935, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58956, CVE-2026-58957, CVE-2026-58958, CVE-2026-58960, CVE-2026-58961, CVE-2026-58962, CVE-2026-58963, CVE-2026-58964, CVE-2026-58965, CVE-2026-58966, CVE-2026-58968, CVE-2026-58969, CVE-2026-58970, CVE-2026-58971, CVE-2026-58972, CVE-2026-58973, CVE-2026-58974, CVE-2026-58975, CVE-2026-58976, CVE-2026-58978, CVE-2026-58979, CVE-2026-58985, CVE-2026-58986, CVE-2026-58988, CVE-2026-58990, CVE-2026-58993, CVE-2026-58994, CVE-2026-58995, CVE-2026-58998, CVE-2026-59000, CVE-2026-59001, CVE-2026-59002, CVE-2026-59003, CVE-2026-59004, CVE-2026-59005, CVE-2026-59006, CVE-2026-59007, CVE-2026-59008, CVE-2026-59011, CVE-2026-59013, CVE-2026-59014, CVE-2026-59015, CVE-2026-59016, CVE-2026-59017, CVE-2026-59020, CVE-2026-59021, CVE-2026-59022, CVE-2026-59023, CVE-2026-59028, CVE-2026-59031, CVE-2026-59032, CVE-2026-59049, CVE-2026-59050, CVE-2026-59051, CVE-2026-59054

Unclassified: CVE-2026-58994
Original source
Similar to GrapheneOS with recent updates:
Sep 17, 2026
Date parsed from source:
Sep 17, 2026

First seen by Releasebot:
Sep 18, 2026
GrapheneOS

2026091700

GrapheneOS ships a September 2026 security preview with Android 17 patches, new clipboard privacy controls, a paste chip in Keyboard, safer call recording defaults, updated kernels, a newer Vanadium build and modem firmware backports for Pixels.

Tags

Changes since the 2026091000 release

All of the Android 17 security patches from the current October 2026, November 2026, December 2026, January 2027, February 2027 and March 2027 Android Security Bulletins are included in the 2026091701 security preview release. List of additional fixed CVEs:

For detailed information on security preview releases, see our .post about it

(Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)2026091700

Pixels: backport cellular modem firmware from Android 17 QPR1

add per-app toggle for disallowing apps reading the clipboard with a global toggle to make it the default (forces pasting via the OS selection toolbar, keyboard apps, keyboard shortcuts or accessibility services)

Keyboard: add paste chip to offer pasting recently copied content when there's nothing else to show as an option

Dialer: default to the contact opt-out mode for users enabling automatic call recording for the first time rather than opt-in

update timezone data to 2026c

kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.177

kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.143

kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.93

add 6.18 kernel branch

Vanadium: update to version 153.0.8010.47.0

adevtool: improve the process-bulletin-patches command

Critical: CVE-2026-55265, CVE-2026-58814, CVE-2026-58865, CVE-2026-58868, CVE-2026-58876, CVE-2026-58880, CVE-2026-58882, CVE-2026-58984

High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2026-0053, CVE-2026-28635, CVE-2026-28643, CVE-2026-28645, CVE-2026-45522, CVE-2026-47964, CVE-2026-49935, CVE-2026-55272, CVE-2026-55274, CVE-2026-55284, CVE-2026-55286, CVE-2026-58866, CVE-2026-58867, CVE-2026-58868, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58883, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58935, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58956, CVE-2026-58957, CVE-2026-58958, CVE-2026-58960, CVE-2026-58961, CVE-2026-58962, CVE-2026-58963, CVE-2026-58964, CVE-2026-58965, CVE-2026-58966, CVE-2026-58968, CVE-2026-58969, CVE-2026-58970, CVE-2026-58971, CVE-2026-58972, CVE-2026-58973, CVE-2026-58974, CVE-2026-58975, CVE-2026-58976, CVE-2026-58978, CVE-2026-58979, CVE-2026-58985, CVE-2026-58986, CVE-2026-58988, CVE-2026-58990, CVE-2026-58993, CVE-2026-58994, CVE-2026-58995, CVE-2026-58998, CVE-2026-59000, CVE-2026-59001, CVE-2026-59002, CVE-2026-59003, CVE-2026-59004, CVE-2026-59005, CVE-2026-59006, CVE-2026-59007, CVE-2026-59008, CVE-2026-59011, CVE-2026-59013, CVE-2026-59014, CVE-2026-59015, CVE-2026-59016, CVE-2026-59017, CVE-2026-59020, CVE-2026-59021, CVE-2026-59022, CVE-2026-59023, CVE-2026-59028, CVE-2026-59031, CVE-2026-59032, CVE-2026-59049, CVE-2026-59050, CVE-2026-59051, CVE-2026-59054

Unclassified: CVE-2026-58994
Original source
Sep 10, 2026
Date parsed from source:
Sep 10, 2026

First seen by Releasebot:
Sep 11, 2026

Modified by Releasebot:
Sep 18, 2026
GrapheneOS

2026091000

GrapheneOS ships a security preview release with Android 17 security patches from October 2026 through March 2027, plus Contact Scopes compatibility fixes, Dialer call recording improvements, SystemUI lockscreen media tweaks, kernel updates, and Vanadium and GmsCompatConfig updates.

Tags

Changes since the 2026090700 release

All of the Android 17 security patches from the current October 2026, November 2026, December 2026, January 2027, February 2027 and March 2027 Android Security Bulletins are included in the 2026091001 security preview release. List of additional fixed CVEs:

For detailed information on security preview releases, see our .post about it

(Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)2026091000

full 2026-09-01 security patch level

Contact Scopes: improve compatibility with certain apps

Dialer: add the option to enable call recording for every contact by default with a list of excluded numbers

Dialer: declare microphone and phone foreground service type to fix automatic call recording for answering calls via Bluetooth

SystemUI: respect lockscreen media setting on always-on display

kernel (6.1): update to latest GKI LTS branch revision

kernel (6.6): update to latest GKI LTS branch revision

kernel (6.12): update to latest GKI LTS branch revision

GmsCompatConfig: update to version 174

Vanadium: update to version 153.0.8010.36.0

adevtool: improve the apply-bulletin-patches command and rename it to process-bulletin-patches

Critical: CVE-2026-55265, CVE-2026-58814, CVE-2026-58865, CVE-2026-58868, CVE-2026-58876, CVE-2026-58880, CVE-2026-58882, CVE-2026-58984

High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2026-0053, CVE-2026-28635, CVE-2026-28643, CVE-2026-28645, CVE-2026-45522, CVE-2026-47964, CVE-2026-49935, CVE-2026-55272, CVE-2026-55274, CVE-2026-55284, CVE-2026-55286, CVE-2026-58866, CVE-2026-58867, CVE-2026-58868, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58883, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58935, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58956, CVE-2026-58957, CVE-2026-58958, CVE-2026-58960, CVE-2026-58961, CVE-2026-58962, CVE-2026-58963, CVE-2026-58964, CVE-2026-58965, CVE-2026-58966, CVE-2026-58968, CVE-2026-58969, CVE-2026-58970, CVE-2026-58971, CVE-2026-58972, CVE-2026-58973, CVE-2026-58974, CVE-2026-58975, CVE-2026-58976, CVE-2026-58978, CVE-2026-58979, CVE-2026-58985, CVE-2026-58986, CVE-2026-58988, CVE-2026-58990, CVE-2026-58993, CVE-2026-58994, CVE-2026-58995, CVE-2026-58998, CVE-2026-59000, CVE-2026-59001, CVE-2026-59002, CVE-2026-59003, CVE-2026-59004, CVE-2026-59005, CVE-2026-59006, CVE-2026-59007, CVE-2026-59008, CVE-2026-59011, CVE-2026-59013, CVE-2026-59014, CVE-2026-59015, CVE-2026-59016, CVE-2026-59017, CVE-2026-59020, CVE-2026-59021, CVE-2026-59022, CVE-2026-59023, CVE-2026-59028, CVE-2026-59031, CVE-2026-59032

Unclassified: CVE-2026-58994
Original source
Sep 7, 2026
Date parsed from source:
Sep 7, 2026

First seen by Releasebot:
Sep 8, 2026
GrapheneOS

2026090700

GrapheneOS releases a security preview with Android 17 security patches through March 2027, plus fixes for a volume bar controls bug and private space search text disappearing on secondary users. It also updates hardened_malloc's libdivide to 5.4.0.

Tags

Changes since the 2026090500 release:

All of the Android 17 security patches from the current September 2026, October 2026, November 2026, December 2026, January 2027, February 2027 and March 2027 Android Security Bulletins are included in the 2026090701 security preview release. List of additional fixed CVEs:

This release fixes an upstream bug in a security preview patch breaking the volume bar button for displaying the rest of the volume controls.

For detailed information on security preview releases, see our .post about it

(Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)2026090700

dismiss app drawer keyboard before private space unlock to fix private space search credential prompt text disappearing on secondary users

hardened_malloc: update libdivide to 5.4.0

Critical: CVE-2026-28591, CVE-2026-28604, CVE-2026-28639, CVE-2026-28653, CVE-2026-28662, CVE-2026-28666, CVE-2026-45515, CVE-2026-45531, CVE-2026-49879, CVE-2026-49882, CVE-2026-49884, CVE-2026-49918, CVE-2026-49921, CVE-2026-49926, CVE-2026-49927, CVE-2026-49932, CVE-2026-49933, CVE-2026-55256, CVE-2026-55265, CVE-2026-55268, CVE-2026-55269, CVE-2026-55273, CVE-2026-55277, CVE-2026-55280, CVE-2026-58814, CVE-2026-58820, CVE-2026-58823, CVE-2026-58835, CVE-2026-58865, CVE-2026-58868, CVE-2026-58876, CVE-2026-58880, CVE-2026-58882, CVE-2026-58984

High: CVE-2025-22424, CVE-2025-22426, CVE-2025-22442, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2025-48600, CVE-2026-0053, CVE-2026-28581, CVE-2026-28582, CVE-2026-28584, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28622, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28627, CVE-2026-28630, CVE-2026-28631, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28638, CVE-2026-28643, CVE-2026-28645, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28664, CVE-2026-28665, CVE-2026-28667, CVE-2026-28668, CVE-2026-28671, CVE-2026-45513, CVE-2026-45514, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45522, CVE-2026-45523, CVE-2026-45524, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-49878, CVE-2026-49880, CVE-2026-49881, CVE-2026-49885, CVE-2026-49887, CVE-2026-49895, CVE-2026-49896, CVE-2026-49912, CVE-2026-49913, CVE-2026-49914, CVE-2026-49923, CVE-2026-49924, CVE-2026-49925, CVE-2026-49931, CVE-2026-49934, CVE-2026-49935, CVE-2026-49937, CVE-2026-55257, CVE-2026-55260, CVE-2026-55261, CVE-2026-55262, CVE-2026-55263, CVE-2026-55264, CVE-2026-55266, CVE-2026-55270, CVE-2026-55271, CVE-2026-55272, CVE-2026-55274, CVE-2026-55278, CVE-2026-55279, CVE-2026-55282, CVE-2026-55284, CVE-2026-55286, CVE-2026-55287, CVE-2026-55288, CVE-2026-55289, CVE-2026-55290, CVE-2026-55292, CVE-2026-55294, CVE-2026-58815, CVE-2026-58817, CVE-2026-58821, CVE-2026-58822, CVE-2026-58834, CVE-2026-58836, CVE-2026-58837, CVE-2026-58838, CVE-2026-58841, CVE-2026-58853, CVE-2026-58854, CVE-2026-58856, CVE-2026-58857, CVE-2026-58859, CVE-2026-58866, CVE-2026-58867, CVE-2026-58868, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58883, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58935, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58945, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58956, CVE-2026-58957, CVE-2026-58958, CVE-2026-58960, CVE-2026-58961, CVE-2026-58962, CVE-2026-58963, CVE-2026-58964, CVE-2026-58965, CVE-2026-58966, CVE-2026-58968, CVE-2026-58969, CVE-2026-58970, CVE-2026-58971, CVE-2026-58972, CVE-2026-58973, CVE-2026-58974, CVE-2026-58975, CVE-2026-58976, CVE-2026-58978, CVE-2026-58979, CVE-2026-58985, CVE-2026-58986, CVE-2026-58988, CVE-2026-58990, CVE-2026-58993, CVE-2026-58994, CVE-2026-58995, CVE-2026-58997, CVE-2026-58998, CVE-2026-59000, CVE-2026-59001, CVE-2026-59002, CVE-2026-59003, CVE-2026-59004, CVE-2026-59005, CVE-2026-59006, CVE-2026-59007, CVE-2026-59008, CVE-2026-59011, CVE-2026-59013, CVE-2026-59014, CVE-2026-59015, CVE-2026-59016, CVE-2026-59017, CVE-2026-59020, CVE-2026-59021, CVE-2026-59022, CVE-2026-59023, CVE-2026-59028, CVE-2026-59032

Unclassified: CVE-2026-58994
Original source
Sep 5, 2026
Date parsed from source:
Sep 5, 2026

First seen by Releasebot:
Sep 6, 2026
GrapheneOS

2026090500

GrapheneOS releases a security preview packed with Android 17 security patches, Launcher privacy and stability fixes, automatic call recording in Dialer, kernel and hardened_malloc improvements, and updated Vanadium plus platform configs.

Tags

Changes since the 2026081300 release

All of the Android 17 security patches from the current September 2026, October 2026, November 2026, December 2026, January 2027, February 2027 and March 2027 Android Security Bulletins are included in the 2026090501 security preview release. List of additional fixed CVEs:

For detailed information on security preview releases, see our .post about it

(Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)2026090500

Launcher: filter Private Space apps from search while it's locked to resolve upstream privacy deficiency (Pixel Launcher delegates search to Android System Intelligence which fixed this already)
Launcher: add "Private Space" action for unlocking the Private Space to app drawer search to match the Pixel Launcher
Launcher: fix upstream crash on large-screen devices when opening a folder from the taskbar with 3-button navigation
Settings: add warning about the standard Android feature for hiding Private Spaces only being superficial and having multiple known tricks for detecting it
Dialer: add support for automatic call recording with a per-call opt-out switch for both incoming and outgoing calls along with a notice of automatic call recording being active during calls
backport upstream Android 17 QPR1 Beta 5 fix for widgets disappearing after reboot
exempt DocumentsUI from redaction of location metadata to resolve upstream bug causing the system file manager to redact location metadata for copies or certain moves
Settings: initialize display color mode to the correct default value to resolve remaining issues with switching back to the default color mode for Pixels caused by an upstream bug not currently impacting the stock Pixel OS
Sandboxed Google Play compatibility layer: fix PackageInstaller.installPackageArchived() stub
hardened_malloc: replace MADV_DONTNEED with MADV_DONTNEED_LOCKED to improve compatibility with mlockall
hardened_malloc: enforce success for MADV_DONTNEED_LOCKED to avoid the need for a memory clearing fallback path
hardened_malloc: avoid unnecessary purging end guard for shrinking large allocations
hardened_malloc: replace MAP_FIXED and fix MREMAP_FIXED ENOMEM handling to fix extreme out-of-memory edge cases where these unmap the target but fail to replace it
kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): update to latest upstream kernel driver sources (replaces our manual backport of CVE-2026-0163)
kernel (6.6, 6.12): add workaround for an upstream arm64 KVM bug breaking booting with lockdown in confidentiality mode (this was previously only applied for a variant of the 6.6 branch specific to 10th gen Pixels but is more broadly applicable)
kernel (6.6): fix edge case error handling for missing SELinux policy in our extensions to SELinux
kernel (6.12): AutoFDO: disable machine function splitting due to an incompatibility with BTI which is enabled by GrapheneOS
kernel (6.1): update to latest GKI LTS branch revision
kernel (6.6): update to latest GKI LTS branch revision
kernel (6.12): update to latest GKI LTS branch revision
Vanadium: update to version 152.0.7977.42.0
Vanadium: update to version 152.0.7977.54.0
Vanadium: update to version 152.0.7977.64.0
Vanadium: update to version 152.0.7977.84.0
GmsCompatConfig: update to version 173
AppCompatConfig: update to version 8
adevtool: add support for unpacking optimized GrapheneOS factory images
adevtool: add an option to use stock OS kernel files for testing purposes
adevtool: improve the apply-bulletin-patches command
Launcher: fix Launcher3QuickStepTests for Android 17
SELinux policy: remove workaround no longer required by our current secure spawning implementation
Critical: CVE-2026-28591, CVE-2026-28604, CVE-2026-28639, CVE-2026-28653, CVE-2026-28662, CVE-2026-28666, CVE-2026-45515, CVE-2026-45531, CVE-2026-49879, CVE-2026-49882, CVE-2026-49884, CVE-2026-49918, CVE-2026-49921, CVE-2026-49926, CVE-2026-49927, CVE-2026-49932, CVE-2026-49933, CVE-2026-55256, CVE-2026-55265, CVE-2026-55268, CVE-2026-55269, CVE-2026-55273, CVE-2026-55277, CVE-2026-55280, CVE-2026-58814, CVE-2026-58820, CVE-2026-58823, CVE-2026-58835, CVE-2026-58865, CVE-2026-58868, CVE-2026-58876, CVE-2026-58880, CVE-2026-58882, CVE-2026-58984
High: CVE-2025-22424, CVE-2025-22426, CVE-2025-22442, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2025-48600, CVE-2026-0053, CVE-2026-28581, CVE-2026-28582, CVE-2026-28584, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28622, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28627, CVE-2026-28630, CVE-2026-28631, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28638, CVE-2026-28643, CVE-2026-28645, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28664, CVE-2026-28665, CVE-2026-28667, CVE-2026-28668, CVE-2026-28671, CVE-2026-45513, CVE-2026-45514, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45522, CVE-2026-45523, CVE-2026-45524, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-49878, CVE-2026-49880, CVE-2026-49881, CVE-2026-49885, CVE-2026-49887, CVE-2026-49895, CVE-2026-49896, CVE-2026-49912, CVE-2026-49913, CVE-2026-49914, CVE-2026-49923, CVE-2026-49924, CVE-2026-49925, CVE-2026-49931, CVE-2026-49934, CVE-2026-49935, CVE-2026-49937, CVE-2026-55257, CVE-2026-55260, CVE-2026-55261, CVE-2026-55262, CVE-2026-55263, CVE-2026-55264, CVE-2026-55266, CVE-2026-55270, CVE-2026-55271, CVE-2026-55272, CVE-2026-55274, CVE-2026-55278, CVE-2026-55279, CVE-2026-55282, CVE-2026-55284, CVE-2026-55286, CVE-2026-55287, CVE-2026-55288, CVE-2026-55289, CVE-2026-55290, CVE-2026-55292, CVE-2026-55294, CVE-2026-58815, CVE-2026-58817, CVE-2026-58821, CVE-2026-58822, CVE-2026-58834, CVE-2026-58836, CVE-2026-58837, CVE-2026-58838, CVE-2026-58841, CVE-2026-58853, CVE-2026-58854, CVE-2026-58856, CVE-2026-58857, CVE-2026-58859, CVE-2026-58866, CVE-2026-58867, CVE-2026-58868, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58883, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58935, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58945, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58956, CVE-2026-58957, CVE-2026-58958, CVE-2026-58960, CVE-2026-58961, CVE-2026-58962, CVE-2026-58963, CVE-2026-58964, CVE-2026-58965, CVE-2026-58966, CVE-2026-58968, CVE-2026-58969, CVE-2026-58970, CVE-2026-58971, CVE-2026-58972, CVE-2026-58973, CVE-2026-58974, CVE-2026-58975, CVE-2026-58976, CVE-2026-58978, CVE-2026-58979, CVE-2026-58985, CVE-2026-58986, CVE-2026-58988, CVE-2026-58990, CVE-2026-58993, CVE-2026-58994, CVE-2026-58995, CVE-2026-58997, CVE-2026-58998, CVE-2026-59000, CVE-2026-59001, CVE-2026-59002, CVE-2026-59003, CVE-2026-59004, CVE-2026-59005, CVE-2026-59006, CVE-2026-59007, CVE-2026-59008, CVE-2026-59011, CVE-2026-59013, CVE-2026-59014, CVE-2026-59015, CVE-2026-59016, CVE-2026-59017, CVE-2026-59020, CVE-2026-59021, CVE-2026-59022, CVE-2026-59023, CVE-2026-59028, CVE-2026-59032
Unclassified: CVE-2026-58994
Original source
Aug 13, 2026
Date parsed from source:
Aug 13, 2026

First seen by Releasebot:
Aug 14, 2026
GrapheneOS

2026081300

GrapheneOS ships a security preview with Android 17 patches for September 2026 through January 2027, major CVE fixes, kernel updates, and Vanadium updates. It also improves Bluetooth, Contact Scopes, and Sandboxed Google Play compatibility, including FCM and Android Auto fixes.
Tags

Changes since the 2026080500 release

All of the Android 17 security patches from the current September 2026, October 2026, November 2026, December 2026 and January 2027 Android Security Bulletins are included in the 2026081301 security preview release. List of additional fixed CVEs:
For detailed information on security preview releases, see our .post about it
(Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)2026081300

Bluetooth: handle nested secondary profiles when sending broadcasts to fix support for wireless Android Auto in nested secondary profiles (Private Spaces and work profiles)

enable multiuser-unaware API usage warnings for Bluetooth processes

Contact Scopes: use identity of the calling app for the filtered query since the query validation, projection mapping, etc. depend on the target SDK version of the calling app (this is a proper solution to the Contact Scopes compatibility issues for WhatsApp and sandboxed Google Play services in Android 17 replacing our previous workaround)

CredentialManager: make CredentialSelectorActivity opaque (avoid showing activity underneath to resolve security vulnerabilities not yet fixed upstream

Sandboxed Google Play compatibility layer: mark all Play services FIDO activities as opaque (avoid showing activity underneath) to resolve Play services security vulnerabilities not yet fixed upstream

Sandboxed Google Play compatibility layer: prevent the Play services from being frozen by the cached app freezer by binding to the persistent process from GmsCompat (this resolves Firebase Cloud Messaging delays)

Sandboxed Google Play compatibility layer: fix race conditions in GLocationService.flushLocations() and PersistentFgService.requestStart() to avoid crashes in edge cases

Sandboxed Google Play compatibility layer: add special handling for Android Auto OutOfCarLifecycle crashes to avoid getting issue reports for expected uncaught exceptions from Android Auto connectivity loss

Sandboxed Google Play compatibility layer: only notify about missing Notifications permission for Play services since other components such as the Play Store handle it themselves

Sandboxed Google Play compatibility layer: switch privSettingsPutStrings() to StringParceledListSlice to handle larger arrays

kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.176

kernel (6.6): update to latest GKI LTS branch revision

kernel (6.12): update to latest GKI LTS branch revision

Vanadium: update to version 151.0.7922.83.0

Vanadium: update to version 151.0.7922.108.0

Vanadium: update to version 151.0.7922.137.0

adevtool: improve the apply-bulletin-patches command

Critical: CVE-2026-28591, CVE-2026-28604, CVE-2026-28639, CVE-2026-28653, CVE-2026-28662, CVE-2026-28666, CVE-2026-45515, CVE-2026-45531, CVE-2026-49879, CVE-2026-49882, CVE-2026-49884, CVE-2026-49918, CVE-2026-49921, CVE-2026-49926, CVE-2026-49927, CVE-2026-49932, CVE-2026-49933, CVE-2026-55256, CVE-2026-55265, CVE-2026-55268, CVE-2026-55269, CVE-2026-55273, CVE-2026-55277, CVE-2026-55280, CVE-2026-58814, CVE-2026-58820, CVE-2026-58823, CVE-2026-58835, CVE-2026-58865, CVE-2026-58868, CVE-2026-58876, CVE-2026-58880, CVE-2026-58882, CVE-2026-58984

High: CVE-2025-22442, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-0053, CVE-2026-28581, CVE-2026-28582, CVE-2026-28584, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28622, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28627, CVE-2026-28630, CVE-2026-28631, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28638, CVE-2026-28643, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28664, CVE-2026-28665, CVE-2026-28667, CVE-2026-28668, CVE-2026-28671, CVE-2026-45513, CVE-2026-45514, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45522, CVE-2026-45523, CVE-2026-45524, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-49878, CVE-2026-49880, CVE-2026-49881, CVE-2026-49885, CVE-2026-49887, CVE-2026-49895, CVE-2026-49896, CVE-2026-49912, CVE-2026-49913, CVE-2026-49914, CVE-2026-49923, CVE-2026-49924, CVE-2026-49925, CVE-2026-49931, CVE-2026-49934, CVE-2026-49935, CVE-2026-49937, CVE-2026-55257, CVE-2026-55261, CVE-2026-55262, CVE-2026-55263, CVE-2026-55264, CVE-2026-55266, CVE-2026-55270, CVE-2026-55271, CVE-2026-55272, CVE-2026-55278, CVE-2026-55279, CVE-2026-55282, CVE-2026-55284, CVE-2026-55286, CVE-2026-55287, CVE-2026-55288, CVE-2026-55289, CVE-2026-55290, CVE-2026-55292, CVE-2026-55294, CVE-2026-58815, CVE-2026-58817, CVE-2026-58821, CVE-2026-58822, CVE-2026-58834, CVE-2026-58836, CVE-2026-58837, CVE-2026-58838, CVE-2026-58841, CVE-2026-58853, CVE-2026-58854, CVE-2026-58856, CVE-2026-58857, CVE-2026-58859, CVE-2026-58860, CVE-2026-58866, CVE-2026-58867, CVE-2026-58868, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58935, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58945, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58956, CVE-2026-58958, CVE-2026-58960, CVE-2026-58961, CVE-2026-58962, CVE-2026-58963, CVE-2026-58964, CVE-2026-58965, CVE-2026-58966, CVE-2026-58968, CVE-2026-58969, CVE-2026-58970, CVE-2026-58971, CVE-2026-58972, CVE-2026-58973, CVE-2026-58974, CVE-2026-58975, CVE-2026-58976, CVE-2026-58978, CVE-2026-58979

Unclassified: CVE-2026-55260, CVE-2026-58883

Original source
Aug 5, 2026
Date parsed from source:
Aug 5, 2026

First seen by Releasebot:
Aug 7, 2026
GrapheneOS

2026080500

GrapheneOS ships a Pixel security patch level update with Android 17 security patches, kernel and firmware fixes, Vanadium and Camera updates, and improvements to Contact Scopes, Sandboxed Google Play compatibility, and adevtool. It also includes a wide set of critical and high severity CVE fixes.

Tags

Changes since the 2026072900 release

All of the Android 17 security patches from the current September 2026, October 2026, November 2026, December 2026 and January 2027 Android Security Bulletins are included in the 2026080501 security preview release. List of additional fixed CVEs:

For detailed information on security preview releases, see our .post about it

(Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)2026080500

full 2026-08-05 Pixel security patch level

update to August 2026 Pixel driver/firmware code

kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): apply fix for CVE-2026-0163

Contact Scopes: add a workaround for WhatsApp ACCOUNT_TYPE queries to resolve an incompatibility introduced with Android 17

Sandboxed Google Play compatibility layer: retain RPC provider connection for out-of-memory adjustment

backport Android 17 QPR1 fix for Bluetooth developer options confirmation

kernel (6.1, 6.6, 6.12): backport patch for CVE-2026-64560

kernel (6.1): update to latest GKI LTS branch revision

kernel (6.6): update to latest GKI LTS branch revision

kernel (6.12): update to latest GKI LTS branch revision

Vanadium: update to version 151.0.7922.71.0

Camera: update to version 91

Camera: update to version 92

Camera: update to version 93

PDF Viewer: update to version 33

adevtool: add command for removing unused device images

adevtool: improve the apply-bulletin-patches command

Critical: CVE-2026-28591, CVE-2026-28604, CVE-2026-28639, CVE-2026-28653, CVE-2026-28662, CVE-2026-28666, CVE-2026-45515, CVE-2026-45531, CVE-2026-49879, CVE-2026-49882, CVE-2026-49884, CVE-2026-49918, CVE-2026-49921, CVE-2026-49926, CVE-2026-49927, CVE-2026-49932, CVE-2026-49933, CVE-2026-55256, CVE-2026-55268, CVE-2026-55269, CVE-2026-55273, CVE-2026-55277, CVE-2026-55280, CVE-2026-58814, CVE-2026-58820, CVE-2026-58823, CVE-2026-58835, CVE-2026-58865, CVE-2026-58868, CVE-2026-58876, CVE-2026-58880, CVE-2026-58882

High: CVE-2025-22442, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-0053, CVE-2026-28581, CVE-2026-28582, CVE-2026-28584, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28622, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28627, CVE-2026-28630, CVE-2026-28631, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28638, CVE-2026-28643, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28664, CVE-2026-28665, CVE-2026-28667, CVE-2026-28668, CVE-2026-28671, CVE-2026-45513, CVE-2026-45514, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45522, CVE-2026-45523, CVE-2026-45524, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-49878, CVE-2026-49880, CVE-2026-49881, CVE-2026-49885, CVE-2026-49887, CVE-2026-49895, CVE-2026-49896, CVE-2026-49912, CVE-2026-49913, CVE-2026-49914, CVE-2026-49923, CVE-2026-49924, CVE-2026-49925, CVE-2026-49931, CVE-2026-49934, CVE-2026-49935, CVE-2026-49937, CVE-2026-55257, CVE-2026-55261, CVE-2026-55262, CVE-2026-55263, CVE-2026-55264, CVE-2026-55266, CVE-2026-55270, CVE-2026-55271, CVE-2026-55272, CVE-2026-55278, CVE-2026-55279, CVE-2026-55282, CVE-2026-55286, CVE-2026-55287, CVE-2026-55288, CVE-2026-55289, CVE-2026-55290, CVE-2026-55292, CVE-2026-55294, CVE-2026-58815, CVE-2026-58817, CVE-2026-58821, CVE-2026-58822, CVE-2026-58834, CVE-2026-58836, CVE-2026-58837, CVE-2026-58838, CVE-2026-58841, CVE-2026-58853, CVE-2026-58854, CVE-2026-58856, CVE-2026-58857, CVE-2026-58859, CVE-2026-58860, CVE-2026-58866, CVE-2026-58867, CVE-2026-58868, CVE-2026-58869, CVE-2026-58870, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58884, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58945, CVE-2026-58946, CVE-2026-58949, CVE-2026-58951, CVE-2026-58953, CVE-2026-58954, CVE-2026-58955, CVE-2026-58957, CVE-2026-58958

Unclassified: CVE-2026-55260, CVE-2026-58883, CVE-2026-58935
Original source
Jul 29, 2026
Date parsed from source:
Jul 29, 2026

First seen by Releasebot:
Jul 31, 2026
GrapheneOS

2026072900

GrapheneOS ships a security preview with Android 17 patches through January 2027, major kernel and app updates, and fixes for app compatibility, WebView, malloc debugging, and rare crashes across Pixel devices.

Tags

Changes since the 2026071500 release:

All of the Android 17 security patches from the current July 2026, August 2026, September 2026, October 2026, November 2026, December 2026 and January 2027 Android Security Bulletins are included in the 2026072901 security preview release. List of additional fixed CVEs:

For detailed information on security preview releases, see our .post about it

(Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)2026072900

extend per-app opt-out for hardened_malloc and extended virtual address space to child processes to support working around rare app compatibility issues involving separate native processes run by an app

override previous SELinux context for secure (exec) spawning to fix compatibility with anti-tampering libraries checking for it

ContactsProvider: fix upstream Android security vulnerability

Telephony: fix upstream Android security vulnerability caused by missing system permission check for apps with API levels below 30

adevtool: include feature flags for Pixel NFC/eSE/eSIM firmware updater to avoid deviating from the stock OS

work around upstream bug for original-package renaming to resolve crashes with Vanadium on OS installs from 4-5 years ago when using the native zygote (we had to temporarily turn off javaless renderers in Vanadium Config 192 and will re-enable it after this OS release)

libpng: backport upstream security patches

kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.175

kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.141

kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.92

improve GrapheneOS package state infrastructure to fix minor rare non-serious bugs

replace our workarounds for pseudo-locale crashes with a proper fix for the issue

Vanadium: update to version 151.0.7922.29.0

Vanadium: update to version 151.0.7922.47.0

Info: update to version 7

GmsCompatConfig: update to version 172

add a way to use any WebView provider on OS debug builds

fix pointer aliasing in malloc dispatch tables to fix malloc debug functionality in certain cases

Critical: CVE-2026-28591, CVE-2026-28604, CVE-2026-28639, CVE-2026-28662, CVE-2026-28666, CVE-2026-45515, CVE-2026-45531, CVE-2026-49879, CVE-2026-49882, CVE-2026-49884, CVE-2026-49918, CVE-2026-49921, CVE-2026-49926, CVE-2026-49927, CVE-2026-49932, CVE-2026-49933, CVE-2026-55256, CVE-2026-55268, CVE-2026-55269, CVE-2026-55273, CVE-2026-55277, CVE-2026-55280, CVE-2026-58814, CVE-2026-58823, CVE-2026-58835, CVE-2026-58865, CVE-2026-58868, CVE-2026-58876, CVE-2026-58880, CVE-2026-58882

High: CVE-2025-22442, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-0053, CVE-2026-28581, CVE-2026-28582, CVE-2026-28584, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28622, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28627, CVE-2026-28630, CVE-2026-28631, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28638, CVE-2026-28643, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28664, CVE-2026-28665, CVE-2026-28667, CVE-2026-28668, CVE-2026-28671, CVE-2026-45513, CVE-2026-45514, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45522, CVE-2026-45523, CVE-2026-45524, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-49878, CVE-2026-49880, CVE-2026-49881, CVE-2026-49885, CVE-2026-49887, CVE-2026-49895, CVE-2026-49896, CVE-2026-49912, CVE-2026-49913, CVE-2026-49914, CVE-2026-49923, CVE-2026-49924, CVE-2026-49925, CVE-2026-49931, CVE-2026-49934, CVE-2026-49935, CVE-2026-49937, CVE-2026-55257, CVE-2026-55261, CVE-2026-55262, CVE-2026-55263, CVE-2026-55264, CVE-2026-55266, CVE-2026-55270, CVE-2026-55271, CVE-2026-55272, CVE-2026-55278, CVE-2026-55279, CVE-2026-55282, CVE-2026-55286, CVE-2026-55287, CVE-2026-55288, CVE-2026-55289, CVE-2026-55290, CVE-2026-55292, CVE-2026-55294, CVE-2026-58815, CVE-2026-58817, CVE-2026-58821, CVE-2026-58822, CVE-2026-58834, CVE-2026-58836, CVE-2026-58837, CVE-2026-58838, CVE-2026-58841, CVE-2026-58853, CVE-2026-58854, CVE-2026-58856, CVE-2026-58857, CVE-2026-58859, CVE-2026-58860, CVE-2026-58866, CVE-2026-58868, CVE-2026-58869, CVE-2026-58871, CVE-2026-58872, CVE-2026-58875, CVE-2026-58877, CVE-2026-58879, CVE-2026-58885, CVE-2026-58886, CVE-2026-58933, CVE-2026-58934, CVE-2026-58937, CVE-2026-58938, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58949

Unclassified: CVE-2026-28653, CVE-2026-55260, CVE-2026-58820, CVE-2026-58883, CVE-2026-58935
Original source
Jul 15, 2026
Date parsed from source:
Jul 15, 2026

First seen by Releasebot:
Jul 16, 2026
GrapheneOS

2026071500

GrapheneOS releases a security preview with Android 17 security patches from July 2026 through January 2027, plus many additional CVE fixes. It also updates Vanadium, improves secure spawning compatibility, and adds kernel and user experience refinements.

Tags

Changes since the 2026071100 release:

All of the Android 17 security patches from the current July 2026, August 2026, September 2026, October 2026, November 2026, December 2026 and January 2027 Android Security Bulletins are included in the 2026071501 security preview release. List of additional fixed CVEs:

For detailed information on security preview releases, see our .post about it

(Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)2026071500

Secure (exec) spawning: skip vkey.android.vos.VosZygotePreload to make exec-based spawning compatible with apps using V-KEY V-OS Mobile App Protection

Secure (exec) spawning: skip redundant mount namespace setup for compatibility with anti-tampering code checking Linux mount IDs

start compat zygote at boot instead of on-demand for compatibility with anti-tampering code checking Linux mount IDs

use lazy preloading for compat zygote to reduce memory usage when it's not used (it's only used for app processes which disable both hardened_malloc and secure spawning)

install CarrierConfig2 in all profiles to avoid using default carrier configuration values in secondary users

notify when Wi-Fi hotspot is disabled due to user change (since users have separate Wi-Fi settings since Android 17) to provide a shortcut for turning it back on via the notification

remove our change raising the zygote's maximum file limit to 256Ki since this has been implemented upstream as a 512Ki limit with correct handling for 32-bit processes

kernel (Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold): integrate minor upstream synopsys driver change unrelated to security

kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.141

Vanadium: update to version 150.0.7871.124.0

add secure spawning file descriptor regression test

Critical: CVE-2026-28591, CVE-2026-28604, CVE-2026-28639, CVE-2026-28662, CVE-2026-28666, CVE-2026-45515, CVE-2026-45531, CVE-2026-49879, CVE-2026-49882, CVE-2026-49884, CVE-2026-49918, CVE-2026-49921, CVE-2026-49926, CVE-2026-49927, CVE-2026-49932, CVE-2026-49933, CVE-2026-55256, CVE-2026-55268, CVE-2026-55269, CVE-2026-55273, CVE-2026-55277, CVE-2026-55280, CVE-2026-58823, CVE-2026-58835, CVE-2026-58865

High: CVE-2025-22442, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-0053, CVE-2026-28581, CVE-2026-28582, CVE-2026-28584, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28622, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28627, CVE-2026-28630, CVE-2026-28631, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28638, CVE-2026-28643, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28664, CVE-2026-28665, CVE-2026-28667, CVE-2026-28668, CVE-2026-28671, CVE-2026-45513, CVE-2026-45514, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45523, CVE-2026-45524, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-49878, CVE-2026-49880, CVE-2026-49881, CVE-2026-49885, CVE-2026-49887, CVE-2026-49895, CVE-2026-49896, CVE-2026-49912, CVE-2026-49913, CVE-2026-49914, CVE-2026-49923, CVE-2026-49924, CVE-2026-49925, CVE-2026-49931, CVE-2026-49934, CVE-2026-49935, CVE-2026-49937, CVE-2026-55257, CVE-2026-55261, CVE-2026-55262, CVE-2026-55263, CVE-2026-55264, CVE-2026-55266, CVE-2026-55270, CVE-2026-55271, CVE-2026-55272, CVE-2026-55278, CVE-2026-55279, CVE-2026-55282, CVE-2026-55286, CVE-2026-55287, CVE-2026-55288, CVE-2026-55289, CVE-2026-55290, CVE-2026-55292, CVE-2026-55294, CVE-2026-58815, CVE-2026-58817, CVE-2026-58821, CVE-2026-58822, CVE-2026-58834, CVE-2026-58836, CVE-2026-58837, CVE-2026-58838, CVE-2026-58841, CVE-2026-58853, CVE-2026-58854, CVE-2026-58856, CVE-2026-58857, CVE-2026-58859, CVE-2026-58860, CVE-2026-58868, CVE-2026-58869

Unclassified: CVE-2026-28653, CVE-2026-55260, CVE-2026-58820
Original source
Jul 11, 2026
Date parsed from source:
Jul 11, 2026

First seen by Releasebot:
Jul 12, 2026
GrapheneOS

2026071100

GrapheneOS ships the 2026071101 security preview with Android 17 July 2026 to January 2027 security patches, a revamped secure exec spawning feature with per-app control, updated kernels and firmware, and fixes for wireless Android Auto, multi-user display, screen recording, and more.

Tags:

Changes since the 2026070500 release:

All of the Android 17 security patches from the current July 2026, August 2026, September 2026, October 2026, November 2026, December 2026 and January 2027 Android Security Bulletins are included in the 2026071101 security preview release. List of additional fixed CVEs:

For detailed information on security preview releases, see our .post about it

(Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)2026071100

replace secure (exec) spawning feature with a new implementation with improved app compatibility and a per-app toggle replacing the previous global toggle
extend exec spawning feature to the native zygote added in Android 17
raise listed security patch level to 2026-07-05 security patch level which has no additional patches listed in either the Android or Pixel bulletin
update to July 2026 Pixel driver/firmware code
fix upstream bug in multi-user handling for the WifiService package state listener which among other possible issues was causing wireless Android Auto compatibility issues in secondary users
fix upstream bug in RemoteException handling for GeocodeProviderBase causing exceptions between the geocoding service and client app to crash the geocoding service
fix external display mirroring in secondary users (upstream bug)
fix handling of multiple users for screen recording (upstream bug)
Sandboxed Google Play compatibility layer: add MODIFY_PHONE_STATE to the special Android Auto phone call permissions toggle since it's needed for managing phone calls in recent versions
kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.140
kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.90
bionic libc: fix API level check for %#m format string (upstream bug)
update_device.py: improve the experience of testing updates on debug builds by avoiding restarting ADB as root
PDF Viewer: update to version 32
Vanadium: update to version 150.0.7871.114.0

Critical: CVE-2026-28591, CVE-2026-28604, CVE-2026-28639, CVE-2026-28662, CVE-2026-28666, CVE-2026-45515, CVE-2026-45531, CVE-2026-49879, CVE-2026-49882, CVE-2026-49884, CVE-2026-49918, CVE-2026-49921, CVE-2026-49926, CVE-2026-49927, CVE-2026-49933

High: CVE-2025-22442, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-28581, CVE-2026-28582, CVE-2026-28584, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28622, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28627, CVE-2026-28630, CVE-2026-28631, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28638, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28664, CVE-2026-28665, CVE-2026-28667, CVE-2026-28668, CVE-2026-28671, CVE-2026-45513, CVE-2026-45514, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45523, CVE-2026-45524, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-49878, CVE-2026-49880, CVE-2026-49881, CVE-2026-49885, CVE-2026-49887, CVE-2026-49895, CVE-2026-49896, CVE-2026-49912, CVE-2026-49913, CVE-2026-49914, CVE-2026-49923, CVE-2026-49924, CVE-2026-49925, CVE-2026-49931, CVE-2026-49934, CVE-2026-49935, CVE-2026-49937, CVE-2026-55257, CVE-2026-55258, CVE-2026-55261, CVE-2026-55262, CVE-2026-55263

Unclassified: CVE-2026-28653, CVE-2026-55260
Original source
Jul 5, 2026
Date parsed from source:
Jul 5, 2026

First seen by Releasebot:
Jul 7, 2026

Modified by Releasebot:
Jul 12, 2026
GrapheneOS

2026070500

GrapheneOS releases a sideload-only update that fixes Android 16 QPR2 recovery sideloading so offline updaters can move to Android 17, while also shipping July 2026 to January 2027 security patches and multiple privacy, kernel, Launcher, and Vanadium fixes.
Users solely doing offline updates via recovery mode sideloading need a to update from Android 16 QPR2 to Android 17. This release fixes upstream bugs for sideloading present in Android 16 QPR2 which prevented updating to Android 17 unless the OS images were far larger than the GrapheneOS ones which triggers a fallback path avoiding the issue.special sideload-only release

Tags

Changes since the 2026062800 release:

All of the Android 17 security patches from the current July 2026, August 2026, September 2026, October 2026, November 2026, December 2026 and January 2027 Android Security Bulletins are included in the 2026070501 security preview release. List of additional fixed CVEs:

For detailed information on security preview releases, see our .post about it

(Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a, emulator, generic, other targets)2026070500

rebuild coarse locations from allowlisted fields to resolve an upstream Android privacy flaw leaking secondary fields such as altitude and accuracy to apps without precise location granted

System UI:: run scroll capture tile handling on main thread to fix an upstream race condition causing memory corruption

Launcher: fix removing space for the quick search bar to avoid removing padding at the bottom

fix PIN scrambling for Private Spaces configured to use parent credentials

implement enhanced PIN privacy for the new PIN pad used outside of the lockscreen

fix handling of TEXT_SHOW_PASSWORD to split TEXT_SHOW_PASSWORD_TOUCH TEXT_SHOW_PASSWORD_PHYSICAL in Android 17

backport security patches for FreeType

kernel (6.1, 6.6, 6.12): fix upstream double-free bug in USB gadget Ethernet driver which was caught by hardware memory tagging in GrapheneOS

kernel (6.1): update to latest GKI LTS branch revision

kernel (6.6): update to latest GKI LTS branch revision

kernel (6.12): update to latest GKI LTS branch revision

kernel (6.1, 6.6, 6.12): backport fixes for CVE-2026-46242

enable precompiling dex bytecode for Vanadium now that the Trichrome Library APK no longer breaks compatibility with it (shared library APKs are incompatible with precompilation and this is the only one in the OS)

Theme Picker: replace references to apps not included in GrapheneOS to avoid black icons

Vanadium: update to version 150.0.7871.63.0

Vanadium: update to version 150.0.7871.63.1

Critical: CVE-2026-28591, CVE-2026-28604, CVE-2026-28639, CVE-2026-28662, CVE-2026-28666, CVE-2026-45515, CVE-2026-45531, CVE-2026-49879, CVE-2026-49882, CVE-2026-49884, CVE-2026-49918, CVE-2026-49921, CVE-2026-49926, CVE-2026-49927, CVE-2026-49933

High: CVE-2025-22442, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2026-28581, CVE-2026-28582, CVE-2026-28584, CVE-2026-28588, CVE-2026-28593, CVE-2026-28594, CVE-2026-28599, CVE-2026-28600, CVE-2026-28602, CVE-2026-28603, CVE-2026-28606, CVE-2026-28607, CVE-2026-28612, CVE-2026-28613, CVE-2026-28614, CVE-2026-28617, CVE-2026-28619, CVE-2026-28620, CVE-2026-28622, CVE-2026-28623, CVE-2026-28624, CVE-2026-28626, CVE-2026-28627, CVE-2026-28630, CVE-2026-28631, CVE-2026-28633, CVE-2026-28634, CVE-2026-28635, CVE-2026-28638, CVE-2026-28650, CVE-2026-28652, CVE-2026-28655, CVE-2026-28657, CVE-2026-28658, CVE-2026-28660, CVE-2026-28663, CVE-2026-28664, CVE-2026-28665, CVE-2026-28667, CVE-2026-28668, CVE-2026-28671, CVE-2026-45513, CVE-2026-45514, CVE-2026-45517, CVE-2026-45518, CVE-2026-45519, CVE-2026-45520, CVE-2026-45521, CVE-2026-45523, CVE-2026-45524, CVE-2026-45525, CVE-2026-45527, CVE-2026-45528, CVE-2026-45529, CVE-2026-49878, CVE-2026-49880, CVE-2026-49881, CVE-2026-49885, CVE-2026-49887, CVE-2026-49895, CVE-2026-49896, CVE-2026-49912, CVE-2026-49913, CVE-2026-49914, CVE-2026-49923, CVE-2026-49924, CVE-2026-49925, CVE-2026-49931, CVE-2026-49934, CVE-2026-49935, CVE-2026-49937, CVE-2026-55257, CVE-2026-55258, CVE-2026-55261, CVE-2026-55262, CVE-2026-55263

Unclassified: CVE-2026-28653, CVE-2026-55260
Original source

Curated by the Releasebot team

Releasebot is an aggregator of official release notes from hundreds of software vendors and thousands of sources.

Our editorial process involves the manual review and audit of release notes procured with the help of automated systems.

About us Our methodology

GrapheneOS Release Notes

2026101600

Changes since the 2026100600 release:

Critical

High

2026100600

Changes since the 2026100200 release:

full 2026-10-05 security patch level

Critical:

High:

2026100200

Tags

Changes since the 2026092500 release

2026092500

Changes since the 2026091900 release:

2026091900

Tags

Changes since the 2026091700 release

Similar to GrapheneOS with recent updates:

2026091700

Tags

Changes since the 2026091000 release

2026091000

Tags

Changes since the 2026090700 release

2026090700

Tags

2026090500

Tags

Changes since the 2026081300 release

2026081300

Tags

Changes since the 2026080500 release

2026080500

Tags

Changes since the 2026072900 release

2026072900

Tags

Changes since the 2026071500 release:

2026071500

Tags

Changes since the 2026071100 release:

2026071100

Tags:

Changes since the 2026070500 release:

2026070500

Tags

Curated by the Releasebot team