Changes in version 146.0.7680.119.0:

• update to Chromium 146.0.7680.119

A full list of changes from the previous release (version 146.0.7680.115.0) is available through the Git commit log between the releases.

This update is available to GrapheneOS users via our app repository and will also be bundled into the next OS release. Vanadium isn't yet officially available for users outside GrapheneOS, although we plan to do that eventually. It won't be able to provide the WebView outside GrapheneOS and will have missing hardening and other features.

Changes in version 146.0.7680.115.0:

• update to Chromium 146.0.7680.115

A full list of changes from the previous release (version 146.0.7680.111.0) is available through the Git commit log between the releases.

This update is available to GrapheneOS users via our app repository and will also be bundled into the next OS release. Vanadium isn't yet officially available for users outside GrapheneOS, although we plan to do that eventually. It won't be able to provide the WebView outside GrapheneOS and will have missing hardening and other features.

🇪🇺 Európsky parlament prijal správu o rozširovaní Európskej únie, v ktorej zdôrazňuje, že prijímanie nových členských štátov je strategickou investíciou do bezpečnosti a stability Európy. Podľa europoslancov je rozširovanie reakciou na meniacu sa geopolitickú situáciu a pomáha predchádzať vzniku tzv. geopolitických „šedých zón“, ktoré by mohli byť vystavené silnejšiemu vplyvu zahraničných mocností.

📊 Parlament zároveň upozorňuje, že náklady na nerozšírenie EÚ by mohli byť vyššie než náklady spojené s prijatím nových členov. Správa pripomína, že niektoré kandidátske krajiny už stanovili konkrétne ciele v prístupových rokovaniach, napríklad Čierna Hora s Albánskom chcú ukončiť rokovania o vstupe do EÚ do roku 2026, respektíve 2027.

👉 Europoslanci zároveň vyzývajú Radu Európskej únie aby podporila tento pokrok, ak bude sprevádzaný reálnymi reformami. Parlament tiež požaduje rýchle otvorenie ďalších rokovacích kapitol s krajinami ako Ukrajina a Moldavsko.

⚖️ Poslanci zároveň zdôrazňujú, že proces vstupu do EÚ musí zostať založený na zásluhách jednotlivých krajín a musí byť podmienený splnením požadovaných reformných krokov. Medzi najdôležitejšie podmienky patria dodržiavanie princípov právneho štátu, demokratické reformy, sloboda médií, ochrana menšín, nezávislosť súdnictva a boj proti korupcii.

📈 Dôležitým ukazovateľom pripravenosti krajín na vstup je aj ich zosúladenie so spoločnou zahraničnou a bezpečnostnou politikou EÚ. Správa zároveň upozorňuje na rastúcu podporu členstva v EÚ na Islande a víta iniciatívy Grónska na posilnenie spolupráce s Európskou úniou.

Notable changes in version 91:

• add support for the Pixel 10a with either the stock OS or future GrapheneOS releases
• update Gradle to 9.4.0
• update Android Gradle plugin to 9.0.0
• update AndroidX Core library to 1.18.0
• update CameraX library to 1.5.3
• update Kotlin to 2.3.10
• update Bouncy Castle to 1.83

A full list of changes from the previous release (version 90) is available through the Git commit log between the releases.

The Auditor app uses hardware security features on supported devices to validate the integrity of the operating system from another Android device. It will verify that the device is running the stock operating system with the bootloader locked and that no tampering with the operating system has occurred. It will also detect downgrades to a previous version.

It cannot be bypassed by modifying or tampering with the operating system (OS) because it receives signed device information from the device's Hardware Security Module (HSM) including the verified boot state, operating system variant and operating system version. The verification is much more meaningful after the initial pairing as the app primarily relies on Trust On First Use via pinning. It also verifies the identity of the device after the initial verification. Trust is chained through the verified OS to the app to bootstrap software checks with results displayed in a separate section.

This app is available through the Play Store with the app.attestation.auditor.play app id. Play Store releases go through review and it usually takes around 1 to 3 days before the Play Store pushes out the update to users. Play Store releases use Play Signing, so we use a separate app id from the releases we publish ourselves to avoid conflicts and to distinguish between them. Each release is initially pushed out through the Beta channel followed by the Stable channel.

Releases of the app signed by GrapheneOS with the app.attestation.auditor app id are published in the GrapheneOS App Store which provides fully automatic updates. Each release is initially pushed out through the Alpha channel, followed by the Beta channel and then finally the Stable channel. These releases are also bundled as part of GrapheneOS and published on GitHub.

🇪🇺 Európsky parlament schválil svoju pozíciu k pripravovanému aktu o Európskom výskumnom priestore. Cieľom je posilniť systém výskumu a inovácií v Európskej únii a zároveň riešiť dlhodobé štrukturálne problémy, ktoré brzdia jeho rozvoj.

👉 Pripravovaný návrh zákona, ktorý má Európska komisia predstaviť v treťom štvrťroku 2026, má vytvoriť silnejší, otvorenejší a konkurencieschopnejší európsky výskumný priestor. Ambíciou je prilákať vedecké talenty z celého sveta a podporiť inovácie, ktoré posilnia ekonomickú konkurencieschopnosť EÚ.
Parlament preto podporuje vznik záväzného európskeho rámca, ktorý by zabezpečil voľný pohyb výskumníkov, vedeckých poznatkov a technológií naprieč Úniou, často označovaný ako „piata sloboda“ jednotného trhu.

💶 Europoslanci zároveň vyzývajú na lepšiu koordináciu výskumných politík a investícií medzi EÚ a členskými štátmi. Podporujú aj cieľ investovať do roku 2030 aspoň 3 % HDP do výskumu a vývoja, a to z verejných aj súkromných zdrojov.
Zdôrazňujú tiež potrebu posilniť spoluprácu medzi univerzitami, výskumnými inštitúciami a priemyslom a zároveň znižovať rozdiely vo výkonnosti výskumu medzi jednotlivými členskými štátmi.

👩‍🔬 Dôležitou súčasťou ambícií je aj lepšia podpora kariér výskumníkov, najmä mladých vedcov, väčšia mobilita talentov a rovnaké príležitosti vrátane podpory rodovej rovnosti vo vede. Uznesenie Európskeho parlamentu tak vysiela jasný politický signál o tom, aké ambície by mal mať pripravovaný legislatívny návrh: byť záväzný, účinný a dostatočne ambiciózny na to, aby pomohol posilniť vedecký výskum v Európe.

Changes in version 146.0.7680.111.0:

• update to Chromium 146.0.7680.111
• simplify disable problematic upstream GPU driver workaround via feature flag
• backport fix for DrumBrake WebAssembly interpreter race conditions
• extend workaround for PowerVR GPU driver bug to be active for Pixel 10 devices by raising the maximum OpenGL ES version for the workaround from 3.0 to 3.2

A full list of changes from the previous release (version 146.0.7680.65.1) is available through the Git commit log between the releases.

This update is available to GrapheneOS users via our app repository and will also be bundled into the next OS release. Vanadium isn't yet officially available for users outside GrapheneOS, although we plan to do that eventually. It won't be able to provide the WebView outside GrapheneOS and will have missing hardening and other features.

We strongly oppose the Unified Attestation initiative and call for app developers supporting privacy, security & freedom on mobile to avoid it. Companies selling phones should not be deciding which operating systems people are allowed to use for apps.

uattest.net

This 🇪🇺 does NOT make bad practices from 🇺🇲 more palatable. People need to stop flag shagging, good tech is good when open auditable & represents freedom regardless of origin. Those behind this are funded by those pushing Chat Control.

Size of companies and their locale is irrelevant when hardware attestation API exists and is open and freely implementable, these are adversarial solutions looking for a problem. That problem they are 'solving' is the free distributiion and use of apps across the Android eco system.

I didn't know these were a good thing but their proponents in this regard must think they are and which by definition this attestation programme is. It is neither utilitarian nor benevolent. One company Google does it, it is monopolistic, multiple do it they become a...cartel.

Further context:
Play Integrity API should be regulated out of existence rather than making another system where companies permit their own products while disallowing others. It shouldn't be legal when Google does it and it shouldn't be legal when Volla and Murena do it either. This is wrong.

We strongly oppose the Unified Attestation initiative and call for app developers supporting privacy, security and freedom on mobile to avoid it. Companies selling phones should not be deciding which operating systems people are allowed to use for apps.

uattest.net/

Google's Play Integrity API is a horrible system enforcing using devices officially licensing Google Mobile Services. It permits those regardless of how many years behind they are on security patches. The solution to this isn't another anti-competitive system based in Europe.

Play Integrity API should be regulated out of existence rather than making another system where companies permit their own products while disallowing others. It shouldn't be legal when Google does it and it shouldn't be legal when Volla and Murena do it either. This is wrong.

Hardware-based attestation has valid use cases including the Auditor app on GrapheneOS for protecting users. The way these companies are using it serves no truly useful purpose beyond giving themselves as unfair advantage while pretending it has something to do with security.

If banks and governments insist on checking devices for security they should define actual standards. It should be possible for any tiny project to be certified at no cost and the standards should be fairly enforced so a mainstream device without current patches is disallowed.

Volla, Murena and iodé sell products with atrocious security. They fail to provide important patches and protections while misleading users with inaccurate claims about privacy and security. That includes setting an inaccurate Android security patch level despite missing patches.

These companies should not have any say over which devices can be used for European banking and government apps. It will reduce competition and reduce security exactly as the Play Integrity API is already doing. The EU should ban using attestation to determine OS compatibility.

Murena and iodé are extremely hostile towards GrapheneOS. They've spent years misleading people about it with inaccurate claims to promote their insecure products. We'll never work with them. Volla, Murena and iodé should have no say in which OS people can use on their devices.

There's no legitimate purpose for either Play Integrity or Unified Attestation to exist. Both will inherently fail to uphold even basic security standards since otherwise their own products wouldn't be allowed. Root-based attestation is also inherently not a secure approach.

Having a European version of the Play Integrity which permits people to use insecure products from specific European companies participating in it while disallowing using arbitrary hardware or software is the opposite of a solution. It's more of the same anti-competitive garbage.

GrapheneOS

2026-03-09 18:35:00

Having a European version of the Play Integrity which permits people to use insecure products from specific European companies participating in it while disallowing using arbitrary hardware or software is the opposite of a solution. It's more of the same anti-competitive garbage.

Changes in version 146.0.7680.65.1:

• revert upstream change triggering memory corruption caught by hardware memory tagging on GrapheneOS

A full list of changes from the previous release (version 146.0.7680.65.0) is available through the Git commit log between the releases.

This update is available to GrapheneOS users via our app repository and will also be bundled into the next OS release. Vanadium isn't yet officially available for users outside GrapheneOS, although we plan to do that eventually. It won't be able to provide the WebView outside GrapheneOS and will have missing hardening and other features.

Tags:

• 2026030700 (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)

Changes since the 2026030500 release:

• update Pixel Camera HAL to CP1A.260305.018 (Android 16 QPR3) to resolve compatibility issues with the backported Android 16 QPR3 kernel drivers
• Pixel 10 Pro Fold: change thermal info configuration to work around an incompatibility with the Android 16 QPR3 kernel device tree
• Setup Wizard: add opt-in toggles for geocoding to the Location services page since we now have a GrapheneOS geocoding service able to handle a large number of users
• replace "OpenStreetMaps" with the correct "OpenStreetMap" for the geocoder server option name
• Vanadium: update to version 146.0.7680.65.0

All of the Android 16 security patches from the current April 2026, May 2026, June 2026, July 2026 and August 2026 Android Security Bulletins are included in the 2026030701 security preview release. List of additional fixed CVEs:

• Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0049, CVE-2026-0052, CVE-2026-0073
• High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2025-48612, CVE-2026-0016, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067, CVE-2026-0070, CVE-2026-0074, CVE-2026-0076

For detailed information on security preview releases, see our post about it.

Changes in version 146.0.7680.65.0:

• update to Chromium 146.0.7680.65
• re-enable use_relative_vtables_abi now that it's compatible with Control Flow Integrity (enabled by GrapheneOS) on arm64 / Android

A full list of changes from the previous release (version 146.0.7680.31.0) is available through the Git commit log between the releases.

This update is available to GrapheneOS users via our app repository and will also be bundled into the next OS release. Vanadium isn't yet officially available for users outside GrapheneOS, although we plan to do that eventually. It won't be able to provide the WebView outside GrapheneOS and will have missing hardening and other features.

Tags:

• 2026030500 (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)

Changes since the 2026030200 release:

• full 2026-03-05 security patch level
• integrate extra security patches not included in the Android Security Bulletin from the March 2026 Android 16 security tag release
• update Pixel kernel sources to CP1A.260305.018 (Android 16 QPR3)
• update Pixel firmware and a large portion of the driver libraries/HALs to CP1A.260305.018 (Android 16 QPR3)
• fix Network permission enforcement for MediaPlayerService clients by closing a bypass caused by an upstream Android vulnerability for INTERNET permission enforcement caused by using case-sensitive rather than case-insensitive string comparisons
• rename geocoder options to "GrapheneOS server" and "OpenStreetMaps server" since we're now self-hosting Nominatim instead of providing a proxy to the OpenStreetMaps instance

All of the Android 16 security patches from the current April 2026, May 2026, June 2026, July 2026 and August 2026 Android Security Bulletins are included in the 2026030501 security preview release. List of additional fixed CVEs:

• Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0049, CVE-2026-0052, CVE-2026-0073
• High: CVE-2025-22424, CVE-2025-22426, CVE-2025-48600, CVE-2025-48612, CVE-2026-0016, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067, CVE-2026-0070, CVE-2026-0074, CVE-2026-0076

For detailed information on security preview releases, see our post about it.

The official microG OS project (lineage.microg.org/) leaked their private keys for logging into their servers and signing releases:

github.com/lineageos4microg/l4…

We make our official builds on local machines. Our signing machine's keys aren't ever on any storage unencrypted.

Our roadmap for improving security of verifying updates is based on taking advantage of the reproducible builds. We plan to have multiple official build locations and a configurable signoff verification system in the update clients also usable with third party signoff providers.

We don't have faith in any available commercial HSM products being more secure than keeping keys encrypted at rest on the primary local build machine. Instead, we're planning to develop software for using the secure element on GrapheneOS phones as an HSM for signing our releases.

GrapheneOS

2026-03-06 14:05:58

We don't have faith in any available commercial HSM products being more secure than keeping keys encrypted at rest on the primary local build machine. Instead, we're planning to develop software for using the secure element on GrapheneOS phones as an HSM for signing our releases.

quasselkopf.de is a single user Mastodon where the sole user is heavily using an LLM to generate posts. They're using AI generated concern trolling to annoy and harass people.

Here's an example of them bothering someone else with AI generated replies:

quasselkopf.de/@kranzkrone/116…

Here's where they began doing it towards us:

quasselkopf.de/@kranzkrone/116…

We posted a constructive reply with useful information so they doubled down on trolling. We called it out and got targeted with abuse.

GrapheneOS

2026-03-05 14:50:46

quasselkopf.de is a single user Mastodon where the sole user is heavily using an LLM to generate posts. They're using AI generated concern trolling to annoy and harass people.

Here's an example of them bothering someone else with AI generated replies:

quasselkopf.de/@kranzkrone/116…

Here's where they began doing it towards us:

quasselkopf.de/@kranzkrone/116…

We posted a constructive reply with useful information so they doubled down on trolling. We called it out and got targeted with abuse.

#fediblock

Stefan (@kranzkrone@quasselkopf.de)

@Magic_Cauldron@treehouse.technopagans.de Backen von Brot ist keine Kunst oder Hexenwerk, dafür brauchst du kein extra Gerät wenn du schon einen Backofen hast.

^{Stefan (QuasselKopf - Person die viel redet.)}

Tags:

• 2026030200 (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)

Changes since the 2026030100 release:

• full 2026-03-01 security patch level

All of the Android 16 security patches from the current April 2026, May 2026, June 2026, July 2026 and August 2026 Android Security Bulletins are included in the 2026030201 security preview release. List of additional fixed CVEs:

• Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0049, CVE-2026-0052
• High: CVE-2025-22424, CVE-2025-22426, CVE-2025-32348, CVE-2025-48600, CVE-2025-48612, CVE-2025-48615, CVE-2025-48617, CVE-2025-48649, CVE-2025-48652, CVE-2026-0016, CVE-2026-0018, CVE-2026-0022, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050, CVE-2026-0053, CVE-2026-0054, CVE-2026-0055, CVE-2026-0056, CVE-2026-0059, CVE-2026-0060, CVE-2026-0061, CVE-2026-0062, CVE-2026-0063, CVE-2026-0065, CVE-2026-0067, CVE-2026-0070

For detailed information on security preview releases, see our post about it.

We recently asked for additional sponsored 10Gbps dedicated servers in Europe. We received over a dozen offers and are still looking into and following those up. So far, we've received a 10Gbps update server from Zare in London and a 20Gbps one in Amsterdam from Cherry Servers.

We now have a total of 5 sponsored update servers:

20Gbps from Cherry Servers in Amsterdam10Gbps from Zare in London10Gbps from Xenyth in Toronto10Gbps from ReliableSite in Miami10Gbps from ReliableSite in Los Angeles

Cherry Servers also provided a 2nd server for geocoding.

We have a full list of our public-facing servers at grapheneos.org/articles/graphe… including details on the sponsored servers with links to the websites of the sponsors. All the update servers are sponsored since paying for the amount of traffic we'll be using would be very expensive.

In addition to the primary purpose of updates, we use these servers as a subset of our 11 locations for website/network services.

We moved our mail server to a system container on the Xenyth server where we're using our own AS and IP space via BGP to avoid spam filtering issues.

We're also going to be using a subset of these as additional ns2 anycast DNS locations. We already use the Xenyth server as 1 of our 9 ns2 locations and plan to use the Zare server for it soon too. This depends on BGP support including BGP communities for traffic engineering.

Cherry Servers also provided a 2nd sponsor server in Amsterdam for us to use as our first geocoding server via Nominatim. Nominatim is very demanding and calls for at least around 128GB of memory and 4TB fast NVMe storage. The initial data import for Nominatim took almost 2 days.

Geocoding means converting the description of a location such as an address or the name of a place to coordinates. It supports many different kinds of searches such as finding a pharmacy or park within a certain zone. There's also reverse search to convert coordinates to names.

We provide geocoding as an opt-in service with a choice between our proxy to the OpenStreetMaps Nominatim server (recommended) or directly using their service. Our proxy will soon be pointed at the server from Cherry Servers and then replaced with a new multi-server GeoDNS setup.

You can try out our new self-hosted geocoding server at ams.nominatim.grapheneos.org/u…. In addition to OpenStreetMaps data, we've imported the primary/secondary Wikipedia importance data, US/UK postcodes, US house data and OSM special phrases. It should be close to the OSM service now.

We provide our own implementation of both network-based location and geocoding in GrapheneOS. Network-based location is implemented with on-device positioning but still depends on a service to obtain location data for nearby networks. We're going to be self-hosting both services.

Settings > Location > Location services provides these settings.

Our added "Geocoder" setting provides a choice of using the GrapheneOS proxy or directly using the OpenStreetMaps service. It will soon change to choosing between our self-hosted service and the OpenStreetMaps one.

Our added "Network location" setting provides a choice between using the GrapheneOS proxy to Apple, Apple or Apple China. We're going to build our own cell tower and Wi-Fi location databases to provide our own non-proxy network location option including full offline support.

For network-based location, enabling "Wi-Fi scanning" is recommended since otherwise it has to fall back to only using cell towers when Wi-Fi is disabled and can't function if cellular is disabled. Wi-Fi scanning changes the meaning of the Wi-Fi toggle to allow scans when off.

Both network-based location and geocoding are opt-in for GrapheneOS. However, we recently added network-based location to our setup wizard to improve discoverability and are going to be adding geocoding there too once we're self-hosting it. OSM server rate limiting was an issue.

We're in the process of getting a sponsored server in Frankfurt from a non-profit with 10G DTAG transit, 10G vodafone and 10G DE-CIX ports in addition to the other transit. DTAG transit is very unique and will be very helpful for serving updates to users in Germany at peak times.

Mullvad will be sponsoring 2 servers for us from DataPacket where DataPacket will bill them for our account under their existing arrangement. We haven't deployed those yet since the locations and specs are more flexible and we want to follow up more less flexible offers first.

These server sponsorships are saving a significant amount of money which can go to hiring more developers instead. There are a bunch other offers we need to filter down to the ones which are a good fit and follow those up. Unfortunately we need to avoid France for the time being.

GrapheneOS

2026-03-03 17:55:54

These server sponsorships are saving a significant amount of money which can go to hiring more developers instead. There are a bunch other offers we need to filter down to the ones which are a good fit and follow those up. Unfortunately we need to avoid France for the time being.

We're happy to announce a long-term partnership with Motorola. We're collaborating on future devices meeting our privacy and security standards with official GrapheneOS support.

motorolanews.com/motorola-thre…

GrapheneOS

2026-03-02 12:34:37

We're happy to announce a long-term partnership with Motorola. We're collaborating on future devices meeting our privacy and security standards with official GrapheneOS support.

motorolanews.com/motorola-thre…

Motorola News | Motorola's new partnership with GrapheneOS

Motorola announces three new B2B solutions at MWC 2026, including GrapheneOS partnership, Moto Analytics and more.

^{marreroc (Global Blog)}