GrapheneOS has raised concerns about Google’s handling of security patches and API releases for the Android operating system, alleging a pattern of withholding updates from non-Pixel device manufacturers. The project also criticized Google’s upcoming app registration requirements, joining a campaign to keep Android open.
According to GrapheneOS, the September 2026 Pixel Update Bulletin included patches extending beyond the standard Android Security Bulletin, specifically impacting standard Android platform code, code used on devices beyond Google’s Pixel line. These platform-level patches have not been included in the regular monthly bulletin or the private preview patches typically provided to other manufacturers. GrapheneOS estimates these patches won't reach other OEMs until the Android 17 QPR2 release in December, characterizing this as Google “gatekeeping security patches to the standard Android platform code from Android OEMs.”
The project also claims Android 17 QPR1 introduced new developer APIs not present in the Android Open Source Project (AOSP), a situation GrapheneOS states hasn’t occurred since Android’s Honeycomb release. Google’s API diff report confirms the addition of the android.hardware.hid package and changes to sixteen others, including android.media, android.os, and android.telecom. GrapheneOS had ported its code to QPR1 before Google’s official release but currently lacks permission to distribute it, leading the project to backport Pixel firmware, kernel drivers, and HALs onto Android 17 instead.
Beyond the patch delays, GrapheneOS highlighted a recurring compliance issue, citing a delay in receiving source code requested on September 1, with access granted over two weeks later. While each issue individually might be considered minor, GrapheneOS argues their combination indicates a trend of Google restricting access to security fixes, withholding APIs, and slowing GPL compliance.
Furthermore, GrapheneOS is opposing Google’s planned requirement for all Android app developers to register with Google, providing legal identification and signing key evidence. Sideloading unverified apps will require enabling developer settings, a 24-hour cooldown period, and multiple warning screens. GrapheneOS has joined the Keep Android Open campaign, alongside organizations like F-Droid, the Electronic Frontier Foundation, and the Free Software Foundation, in opposing this measure.
Read the original coverage
💬 Comments
📜 Comment Policy