**[2022013010](https://grapheneos.org/releases#2022013010)** Tags: - [SP1A.210812.016.A2.2022013010](https://github.com/GrapheneOS/platform_manifest/releases/tag/SP1A.210812.016.A2.2022013010) (Pixel 3, Pixel 3 XL) — extended support release for legacy devices with frozen 2021-11-01 patch level - [SQ1A.220105.002.2022013010](https://github.com/GrapheneOS/platform_manifest/releases/tag/SQ1A.220105.002.2022013010) (Pixel 3a, Pixel 3a XL, Pixel 4, Pixel 4 XL, Pixel 4a, Pixel 4a (5G), Pixel 5, Pixel 5a, emulator, generic, other targets) - [SQ1D.220105.007.2022013010](https://github.com/GrapheneOS/platform_manifest/releases/tag/SQ1D.220105.007.2022013010) (Pixel 6, Pixel 6 Pro) Changes since the 2022011423 release: - make DownloadManager friendlier to apps with the Network permission revoked instead of triggering SecurityException - Sandboxed Google Play compatibility layer: revert marking location service as a foreground location service (not necessary) - Sandboxed Google Play compatibility layer: add compatibility shims enabling full support for using Play services geolocation - Sandboxed Google Play compatibility layer: add GmsCompat app providing infrastructure for the compatibility layer and shortcuts to Google Play configuration activities (will toggle for redirecting the Google Play geolocation API in a future release) - Sandboxed Google Play compatibility layer: replace converting Google Play services to foreground services with keeping them alive using the GmsCompat app - Dialer: update visual voicemail configuration based on Google Phone 73.0.414822266 - Messaging: replace obsolete AOSP MMS configuration database with one generated from the stock OS app - Vanadium: update Chromium base to 97.0.4692.98 - Vanadium: use Google Chrome branding for client hints to help with blending in - Vanadium: enable HTTPS-only mode by default (can connect via HTTP through the warning screen if HTTPS upgrade fails) - Vanadium: enable strict origin isolation by default - Vanadium: disable appending variations header - Camera: update to [version 10](https://github.com/GrapheneOS/Camera/releases/tag/10) - Auditor: update to [version 41](https://github.com/GrapheneOS/Auditor/releases/tag/41) - hardened_malloc: code cleanup and micro-optimizations - adevtool: initial public release replacing pre-generated vendor trees - adevtool: overhaul of GrapheneOS specific configuration [Twitter](https://twitter.com/GrapheneOS/status/1488067698730885123) / [Nitter](https://nitter.eu/GrapheneOS/status/1488067698730885123) | [Reddit](https://www.reddit.com/r/GrapheneOS/comments/sgwfa4/grapheneos_version_2022013010_released/) / [Teddit](https://www.teddit.net/r/GrapheneOS/comments/sgwfa4/grapheneos_version_2022013010_released/)

**[2021121602](https://grapheneos.org/releases#2021121602)** Tags: - [SP1A.210812.015.2021121602](https://github.com/GrapheneOS/platform_manifest/releases/tag/SP1A.210812.015.2021121602) (Pixel 3, Pixel 3 XL) — extended support release for legacy devices with frozen 2021-11-01 patch level - [SQ1A.211205.008.2021121602](https://github.com/GrapheneOS/platform_manifest/releases/tag/SQ1A.211205.008.2021121602) (Pixel 3a, Pixel 3a XL, Pixel 4, Pixel 4 XL, Pixel 4a, Pixel 4a (5G), Pixel 5, Pixel 5a, emulator, generic, other targets) Changes since the 2021121012 release: - Vanadium: update Chromium base to 96.0.4664.104 - skip reporting network connectivity to the OS from apps with the Network (INTERNET) permission revoked to avoid triggering a SecurityException - remove special case of throwing SecurityException for socket errors caused by EACCES/EPERM as a debugging aid since it causes compatibility issues when the Network (INTERNET) permission is revoked - kernel (Pixel 4, Pixel 4 XL, Pixel 4a, Pixel 4a (5G), Pixel 5, Pixel 5a): fix incorrect alloc_size annotation (already fixed in older kernels and no real world impact) [Twitter](https://twitter.com/GrapheneOS/status/1471604086961315847) / [Nitter](https://nitter.net/GrapheneOS/status/1471604086961315847) | [Reddit](https://reddit.com/r/GrapheneOS/comments/ri1oj2/grapheneos_2021121602_release/) / [Teddit](https://teddit.net/r/GrapheneOS/comments/ri1oj2/grapheneos_2021121602_release/)

**[2021120717](https://grapheneos.org/releases#2021120717)** Tags: - [SP1A.210812.015.2021120717](https://github.com/GrapheneOS/platform_manifest/releases/tag/SP1A.210812.015.2021120717) (Pixel 3, Pixel 3 XL) — extended support release for legacy devices with frozen 2021-11-01 patch level - [SQ1A.211205.008.2021120717](https://github.com/GrapheneOS/platform_manifest/releases/tag/SQ1A.211205.008.2021120717) (Pixel 3a, Pixel 3a XL, Pixel 4, Pixel 4 XL, Pixel 4a, Pixel 4a (5G), Pixel 5, Pixel 5a, emulator, generic, other targets) Changes since the 2021112404 release: - full 2021-12-01 security patch level - full 2021-12-05 security patch level - rebased onto SQ1A.211205.008 release, the first quarterly maintenance/feature release for Android 12 - Sandboxed Play services compatibility layer: improve robustness of Play Store compatibility layer - Camera: update to [version 7](https://github.com/GrapheneOS/Camera/releases/tag/7) - TalkBack (screen reader): update dependencies - avoid per-network randomization mode (AOSP default) being displayed as per-connection randomization mode (GrapheneOS default not available in AOSP) after rebooting despite persisting and working properly (caused by an additional abstraction layer introduced in Android 12) [Twitter](https://twitter.com/GrapheneOS/status/1468387568672718852) / [Nitter](https://nitter.net/GrapheneOS/status/1468387568672718852) | [Reddit](https://www.reddit.com/r/GrapheneOS/comments/rbeo2g/grapheneos_2021120717_release/) / [Teddit](https://teddit.net/r/GrapheneOS/comments/rbeo2g/grapheneos_2021120717_release/)

**[2021112404](https://grapheneos.org/releases#2021112404)** Tags: - [SP1A.210812.015.2021112404](https://github.com/GrapheneOS/platform_manifest/releases/tag/SP1A.210812.015.2021112404) (Pixel 3, Pixel 3 XL) — extended support release for legacy devices with frozen 2021-11-01 patch level - [SP1A.211105.002.2021112404](https://github.com/GrapheneOS/platform_manifest/releases/tag/SP1A.211105.002.2021112404) (Pixel 3a, Pixel 3a XL) - [SP1A.211105.003.2021112404](https://github.com/GrapheneOS/platform_manifest/releases/tag/SP1A.211105.003.2021112404) (Pixel 5a) - [SP1A.211105.004.2021112404](https://github.com/GrapheneOS/platform_manifest/releases/tag/SP1A.211105.004.2021112404) (Pixel 4, Pixel 4 XL, Pixel 4a, Pixel 4a (5G), Pixel 5, emulator, generic, other targets) - [SD1A.210817.037.2021112404](https://github.com/GrapheneOS/platform_manifest/releases/tag/SD1A.210817.037.2021112404) (Pixel 6, Pixel 6 Pro) — incomplete support for 6th generation Pixels (no official builds) Changes since the 2021112123 release: - Sandboxed Play services compatibility layer: add another UserManager shim to fix issue with FCM in secondary user profiles - Sandboxed Play services compatibility layer: mark Play Store confirmation notification as ongoing to avoid users dismissing the notification and then being unable to accept or reject the install/update/uninstall action - Camera: update to [version 6](https://github.com/GrapheneOS/Camera/releases/tag/6) [Twitter](https://twitter.com/GrapheneOS/status/1463690375164477440) / [Nitter](https://nitter.net/GrapheneOS/status/1463690375164477440) | [Reddit](https://www.reddit.com/r/GrapheneOS/comments/r1lb8j/grapheneos_2021112404_release/) / [Teddit](https://teddit.net/r/GrapheneOS/comments/r1lb8j/grapheneos_2021112404_release/)

**[2021110617](https://grapheneos.org/releases#2021110617)** Tags: - [SP1A.210812.015.2021110617](https://github.com/GrapheneOS/platform_manifest/releases/tag/SP1A.211105.002.2021110617) (Pixel 3, Pixel 3 XL) — extended support release for legacy devices with frozen 2021-11-01 patch level - [SP1A.211105.002.2021110617](https://github.com/GrapheneOS/platform_manifest/releases/tag/SP1A.211105.002.2021110617) (Pixel 3a, Pixel 3a XL) - [SP1A.211105.003.2021110617](https://github.com/GrapheneOS/platform_manifest/releases/tag/SP1A.211105.003.2021110617) (Pixel 5a) - [SP1A.211105.004.2021110617](https://github.com/GrapheneOS/platform_manifest/releases/tag/SP1A.211105.004.2021110617) (Pixel 4, Pixel 4 XL, Pixel 4a, Pixel 4a (5G), Pixel 5, emulator, generic, other targets) Changes since the 2021110507 release: - GrapheneOS Camera: update to [version 3](https://github.com/GrapheneOS/Camera/releases/tag/3) - revert hard-wiring camera gesture handler as a workaround for AOSP 12 bug with the gesture on the lockscreen - Vanadium: add workaround for upstream bug with login when sandboxed Play services is present - android-prepare-vendor: overhaul Pixel 4a (5G), Pixel 5 and Pixel 5a support including building more AOSP modules

Official Live event, #Pixel6Launch, is on Made by Google channel. October 19th, 2021 @ 10am PT. https://youtube.com/watch?v=WNarpiGz3Kk Or https://invidious.snopyta.org/watch?v=WNarpiGz3Kk

Hi, The community for AndroidApps on Lemmy.ml ( https://lemmy.ml/c/androidapps ) no longer has a mod. The mod account of https://lemmy.ml/u/TheSilencedOne has been deleted. Requesting mod status for [!androidapps@lemmy.ml](https://lemmy.ml/c/androidapps) community, and my recent post on c/AndroidApps: https://lemmy.ml/post/85558 Thank you for your time. Regards, akc3n

> The Auditor app uses hardware security features on supported devices to validate the integrity of the operating system from another Android device. It will verify that the device is running the stock operating system with the bootloader locked and that no tampering with the operating system has occurred. It will also detect downgrades to a previous version. Auditor app version 34 released: https://github.com/GrapheneOS/Auditor/releases/tag/34 See the linked release notes for an overview of the improvements and a link to the full list of changes. See https://attestation.app/about and https://attestation.app/tutorial for info about the app and optional monitoring service.

Auditor app version 34 released: https://github.com/GrapheneOS/Auditor/releases/tag/34 See the linked release notes for an overview of the improvements and a link to the full list of changes. See https://attestation.app/about and https://attestation.app/tutorial for info about the app and optional monitoring service.

Auditor app version 34 released: https://github.com/GrapheneOS/Auditor/releases/tag/34 See the linked release notes for an overview of the improvements and a link to the full list of changes. See https://attestation.app/about and https://attestation.app/tutorial for info about the app and optional monitoring service.

**Pixel Fall Launch** > On October 19, we’re officially introducing you to Pixel 6 and Pixel 6 Pro—the completely reimagined Google phones. Powered by Tensor, Google’s first custom mobile chip, they’re fast, smart and secure. And they adapt to you.

**Pixel Fall Launch** > On October 19, we’re officially introducing you to Pixel 6 and Pixel 6 Pro—the completely reimagined Google phones. Powered by Tensor, Google’s first custom mobile chip, they’re fast, smart and secure. And they adapt to you.

**Android Security Bulletins** Monthly device updates are an important tool to keep Android users safe and protect their devices. This page contains the available Android Security Bulletins, which provide fixes for possible issues affecting devices running Android. Android device and chipset manufacturers may also publish security vulnerability details specific to their products, such as: - [Google](https://source.android.com/security/bulletin/pixel) - [Huawei](https://consumer.huawei.com/en/support/bulletin/) - [LG](https://lgsecurity.lge.com/security_updates_mobile.html) - [Motorola](https://motorola-global-portal.custhelp.com/app/software-security-page/g_id/6806) - [Nokia](https://www.nokia.com/en_int/phones/security-updates) - [OnePlus](https://security.oneplus.com/mend.html) - [Oppo](https://security.oppo.com/en/mend) - [Samsung](https://security.samsungmobile.com/securityUpdate.smsb) Learn how to check and update your Android version [here](https://support.google.com/android/answer/7680439?hl=en). **Sources** Fixes listed in the public bulletin come from various different sources: the Android Open Source Project (AOSP), the upstream Linux kernel, and system-on-chip (SOC) manufacturers. For device manufacturers: - Android platform fixes are merged into AOSP 24–48 hours after the security bulletin is released and can be picked up directly from there. - Upstream Linux kernel fixes are linked to directly from the bulletin on release and can be picked up from there. - Fixes from SOC manufacturers are available directly from the manufacturers. **Bulletins** https://source.android.com/security/bulletin#bulletins

Hi, Would like to please request mod status on [!androidofficial@lemmy.ml](https://lemmy.ml/c/androidofficial) Link to comment https://lemmy.ml/post/84266 Thank you for your time. Regards, akc3n

Today we’re pushing the source to the Android Open Source Project (AOSP) and officially releasing the latest version of Android. Keep an eye out for Android 12 coming to a device near you starting with Pixel in the next few weeks and Samsung Galaxy, OnePlus, Oppo, Realme, Tecno, Vivo, and Xiaomi devices later this year. ... [~Source~](https://android-developers.googleblog.com/2021/10/android-12-is-live-in-aosp.html)

**Hello and welcome to [!grapheneos@lemmy.ml](https://lemmy.ml/c/grapheneos) !** Our Lemmy GrapheneOS community is *currently* `unofficial`, `reserved`, and used for announcements/news. GrapheneOS is a privacy and security focused mobile OS with Android app compatibility. https://grapheneos.org/ https://attestation.app/ https://github.com/GrapheneOS Official chat rooms: [#grapheneos:grapheneos.org]( https://app.element.io/#/room/%23grapheneos:grapheneos.org) and [#offtopic:grapheneos.org](https://app.element.io/#/room/%23offtopic:grapheneos.org) This is a community based around the GrapheneOS projects including the hardened Android Open Source Project fork, Auditor, AttestationServer, the hardened malloc implementation and other projects. --- **All installs should follow the [Official Install Guide](https://grapheneos.org/install). No other guides are recommended or supported.** If your question is related to device support, please see the [Which devices will be supported in the future?](https://grapheneos.org/faq#future-devices) for criteria and the [Which devices are recommended?](https://grapheneos.org/faq#recommended-devices) for recommend devices from the [FAQ](https://grapheneos.org/faq) section of the official site. If your question is related to app support, please check the [Usage Guide](https://grapheneos.org/usage). Sections like [Bugs uncovered by security features](https://grapheneos.org/usage#bugs-uncovered-by-security-features) should help if you have a native app with a security issue uncovered by hardening. If you want to know what browser to use please reference [Web browsing](https://grapheneos.org/usage#web-browsing). In general, Vanadium is almost always the recommendation for security and privacy. If your question is related to a feature request, please check the issue trackers. [OS issue tracker](https://github.com/GrapheneOS/os_issue_tracker/issues), [Vanadium](https://github.com/GrapheneOS/Vanadium/issues) for other GrapheneOS project check the [Reporting issue](https://grapheneos.org/contact#reporting-issues). --- **GrapheneOS has a very active community primarily based around the official chat rooms on Matrix and where most of the core community, including contributors, to the project have discussions. Most of those people are not active here on Lemmy's [!grapheneos@lemmy.ml](https://lemmy.ml/c/grapheneos) community.** The official GrapheneOS space groups together all of the official rooms along with members of the community who join the space. You can join the space at [#community:grapheneos.org](https://app.element.io/#/room/%23community:grapheneos.org) Links to join our new official chat rooms via the Element web client: | Matrix Room | Description | | --------------------- | ------------------ | | [#grapheneos:grapheneos.org]( https://app.element.io/#/room/%23grapheneos:grapheneos.org) | Best place to request support, ask questions or get involved in the project | | [#offtopic:grapheneos.org](https://app.element.io/#/room/%23offtopic:grapheneos.org) | Discuss topics not strictly related to GrapheneOS | | [#dev:grapheneos.org](https://app.element.io/#/room/%23dev:grapheneos.org) | Discuss GrapheneOS app and OS development | | [#testing:grapheneos.org](https://app.element.io/#/room/%23testing:grapheneos.org) | Provide feedback on Beta channel releases | | [#releases:grapheneos.org](https://app.element.io/#/room/%23releases:grapheneos.org) | Release announcements | | [#infra:grapheneos.org](https://app.element.io/#/room/%23infra:grapheneos.org) | Infrastructure monitoring and discussion | You can use the client and home server of your choice. For new users, the Element web app or mobile app with matrix.org as your home server is a sensible choice. Please contact the moderators of this community if you have any questions or concerns.

**[2021100103](https://grapheneos.org/releases#2021100103)** Tags: - [RQ3A.210905.001.2021100103](https://github.com/GrapheneOS/platform_manifest/releases/tag/RQ3A.210905.001.2021100103) (Pixel 3, Pixel 3 XL, Pixel 3a, Pixel 3a XL, Pixel 4, Pixel 4 XL, Pixel 4a, Pixel 4a (5G), Pixel 5, emulator, generic, other targets) - [RD2A.210905.003.2021100103](https://github.com/GrapheneOS/platform_manifest/releases/tag/RD2A.210905.003.2021100103) (Pixel 5a) Changes since the 2021092612 release: - Vanadium: update Chromium base to 94.0.4606.71 - change generated carrier configurations to always allow editing APNs - always show APN settings on CDMA carriers - automate APN / carrier settings updates

**[2021092612](https://grapheneos.org/releases#2021092612)** Tags: - [RQ3A.210905.001.2021092612](https://github.com/GrapheneOS/platform_manifest/releases/tag/RQ3A.210905.001.2021092612) (Pixel 3, Pixel 3 XL, Pixel 3a, Pixel 3a XL, Pixel 4, Pixel 4 XL, Pixel 4a, Pixel 4a (5G), Pixel 5, emulator, generic, other targets) - [RD2A.210905.003.2021092612](https://github.com/GrapheneOS/platform_manifest/releases/tag/RD2A.210905.003.2021092612) (Pixel 5a) Changes since the [2021092220](https://grapheneos.org/releases#2021092220) release: - kernel (Pixel 3, Pixel 3 XL, Pixel 3a, Pixel 3a XL): apply upstream fix for ION use-after-free vulnerability - Vanadium: update Chromium base to 94.0.4606.61 - android-prepare-vendor: remove a bunch of unused code / functionality - android-prepare-vendor: skip all kernel modules

Hi, Requesting mod status on [!aosp@lemmy.ml](https://lemmy.ml/c/aosp) Link to comment https://lemmy.ml/post/82646 Thank you for your time. Regards, akc3n

Coming soon.

Hi, The community for TheHatedOne on Lemmy.ml ( https://lemmy.ml/c/thehatedone ) no longer has a mod. The mod account of https://lemmy.ml/u/TheSilencedOne has been deleted. Requesting mod status on c/thehatedone Thank you for your time. Regards, akc3n EDIT: linked comments of mine in c/thehatedone https://lemmy.ml/post/79906

Ultrasonic Cross Device Tracking and how to prevent it using GrapheneOS.

Hi, The community for GrapheneOS on Lemmy.ml no longer has a mod. The account of [@secure_computers@lemmy.ml](https://lemmy.ml/u/secure_computers) has been deleted and the user was unaffiliated with us. I am one of the mods in our matrix rooms in #community:grapheneos.org and would like to reclaim/reserve this lemmy.ml community for the GrapheneOS project. Please let me know how we maybe able to proceed. Thank you for your time. Regards, akc3n EDIT: linked comments of mine in c/GrapheneOS https://lemmy.ml/post/79721 https://lemmy.ml/post/79463

Changes since the 2021082501 release: - Settings: add back past GrapheneOS feature for toggling whether secondary users can install new apps - Vanadium: update Chromium base to 92.0.4515.166 - Vanadium: update Chromium base to 93.0.4577.62 - Vanadium: hide sign in preference when disallowed - Vanadium: disable using Play services as a source for certain Google fonts - automatically disable UART debugging when flashing factory images (GrapheneOS already extends the notification about it to production builds) - Auditor: update to [version 29](https://github.com/GrapheneOS/Auditor/releases/tag/29) - SetupWizard: properly disable system UI navigation for the entire setup process - kernel (Pixel 4a (5G), Pixel 5): drop unnecessary Wi-Fi driver change from our previous downstream security fixes - Pixel 4, Pixel 4 XL: enable saturated color option

**Attestation compatibility guide** *Guide on using remote attestation in a way that's compatible with GrapheneOS* https://grapheneos.org/articles/attestation-compatibility-guide Apps using SafetyNet attestation to check the authenticity/integrity of the OS can support GrapheneOS by using the standard Android hardware attestation API and permitting our official release signing keys. Android's [hardware attestation API](https://developer.android.com/training/articles/security-key-attestation) provides a much stronger form of attestation than SafetyNet with the ability to whitelist the keys of alternate operating systems. It also avoids an unnecessary dependency on Google Play services and Google's SafetyNet servers. Devices have been required to ship with hardware attestation support since Android 8. You can use hardware attestation on devices running Android 8 or later when the `ro.product.first_api_level` system property isn't set to 25 or below, which indicates they launched with Android 8 or later with hardware attestation support as a mandatory feature. On older devices, you can continue using SafetyNet attestation. Some low quality devices shipped broken implementations of hardware attestation despite the requirement to have it working for CDD/CTS certification and SafetyNet currently still passes on those devices wrongly claiming them to be CTS certified. If you don't want to fail on those devices, then you can start with hardware attestation and fall back to SafetyNet attestation or do both and accept either passing as success. After verifying the signature of the attestation certificate chain and extracting the attestation metadata, you can enforce that `verifiedBootState` is either `Verified` or `SelfSigned`. For the `SelfSigned` case, you can check that `verifiedBootKey` matches one of the official GrapheneOS verified boot keys. These are the base16-encoded verified boot key fingerprints for the official GrapheneOS releases: - `0abddeda03b6ce10548c95e0bea196faa539866f929bcdf7eca84b4203952514`: Pixel 5a - `36a99eab7907e4fb12a70e3c41c456bcbe46c13413fbfe2436adee2b2b61120f`: Pixel 5 - `dcec2d053d3ec4f1c9be414aa07e4d7d7cbd12040ad2f8831c994a83a0536866`: Pixel 4a (5G) - `3f15fdcb82847fed97427ce00563b8f9ff34627070de5fdb17aca7849ab98cc8`: Pixel 4 XL - `80ef268700ee42686f779a47b4a155fe1ffc2eedf836b4803caab8fa61439746`: Pixel 4 - `9f2454a1657b1b5ad7f2336b39a2611f7a40b2e0ddfd0d6553a359605928df29`: Pixel 4a - `3f36e3482e1ff82986576552cb4fd08af09f8b09d3832314341e04c42d2919a4`: Pixel 3a XL - `73d6c63a07610404fe16a4e07dd24e41a70d331e9d3ef7bba2d087e4761eb63a`: Pixel 3a - `06dd526ee9b1cb92aa19d9835b68b4ff1a48a3ad31d813f27c9a7d6c271e9451`: Pixel 3 XL - `0f9a9cc8ade73064a54a35c5509e77994e3aa37b6fb889dd53af82c3c570c5cf`: Pixel 3 The `verifiedBootKey` field is binary data so you either need to encode it as base16 to compare with these or convert these to binary. An easy approach is storing the permitted key fingerprints in a set and enforcing that the verified boot key is in the permitted set when `verifiedBootState` is `SelfSigned`. GrapheneOS regularly adds support for new devices so you should have a process for regularly adding the new verified boot key fingerprints from this page. The hardware attestation API also provides other useful information signed by the hardware including the OS patch level, in a way that even an attacker exploiting the OS after boot to gain root cannot trivially bypass. It's a better feature than the SafetyNet API designed for the lowest common denominator. [GrapheneOS](https://grapheneos.org) users are strongly encouraged to share this documentation with app developers enforcing only being able to use the stock OS. Send an email to the developers and leave a review of the app with a link to this information. Share it with other users and create pressure to support GrapheneOS rather than locking users into the stock OS without a valid security reason. GrapheneOS not only upholds the app security model but substantially reinforces it, so it cannot be justified with reasoning based on security, anti-fraud, etc. *[GrapheneOS's attestation service has a page explaining how the Auditor app and attestation service work](https://attestation.app/about).*