Hacker News Reader

Comment by Retr0id | Hacker News Reader

Google is also seriously dropping the ball in terms of security. The CVE-2026-43499 root LPE (aka ghostlock) is still unpatched across all Pixel devices, on the latest """security""" update, despite weaponized exploits being public for months.

View on HN

Pixels used to have far better updates than any other Android devices but they stopped improving it years ago. It should have kept improving because it's not at all adequate. They need to be able to release OS updates more than once per month and it shouldn't take months for patches to make it into the OS. It currently takes them at least around 2 months to get even the most urgent patches into the OS. They could fix emergency calls being broken if the patch was made around 3 weeks before an OS release, but that's about as quick as they can go. It's not at all adequate for security and is a complete joke compared to Chromium's release cycle. They can get an emergency Chrome update released within a couple days. They should at least be able to do it for the Pixel OS in a week.

GrapheneOS is often around 4 to 6 months ahead on merging Linux kernel LTS releases. We used to handle this ourselves but switched to the Android GKI LTS branch maintained by Greg KH. Unfortunately, it was often struggling to keep up even before the absolutely massive increase in Linux kernel security patches this year. AI models have rapidly accelerated vulnerability discovery and it's an ongoing crisis for the Linux kernel. We want to be on the latest LTS revision within days and want to be using the latest LTS branch within months of it being released. We're not at all happy with how Android is handling things and plan to fix that ourselves. We'll get things back to how they should be.

We also ship all the AOSP userspace patches months before Pixels due to shipping all of the security preview patches as soon as possible. There are sometimes minor regressions but we find and fix them ourselves downstream. The security preview system has a terrible design especially considering that frontier AI models can reverse engineer the patches. There should at least only be a source embargo for around 24 to 72 hours rather than pretending as if it can work with the patches available 2 to 6 months in advance.

I'd love to use GrapheneOS on less secure devices, just for the sake of Google autonomy rather than privacy.

GrapheneOS will be available on Motorola devices meeting all of our requirements for updates and security features in 2027. It will be starting out on a high end flagship and expanding down from there as devices improve to meet our requirements. We aren't going to support devices unable to provide a reasonable level of security.

Why? Just release Graphene without those security requirements. It must be a user's choice and responsibility. You sound exactly the people you fight against.

You understand that just having a firewall is a big step for security?

Diverting a massive amount of resources to devices where we can never provide decent updates and our core security features doesn't interest us. It would reduce the privacy, security, usability, app compatibility and robustness of GrapheneOS for users on the officially supported devices. It would also result in many people getting insecure devices. Many people would get those devices and then realize they made a poor decision later. We already see this happen with devices approaching end-of-life and already have to put significant work into avoiding people getting those.

GrapheneOS is permissively licensed so that people can do exactly that (and fork for different hardware platforms) if they want to. It is a donation-supported open source project with a small team, and it is not a crime or moral failing for them to put those resources into doing the best that they can, instead of spreading themselves thin on something they cannot be motivated or proud of.

> a reasonable level of security

Whould you recommend using a Pixel 6a in 2026 even though it has no hardware memory tagging (MTE)?

GrapheneOS's goal is privacy for the world and that's achieved through secure devices. You can get a phone specifically for GrapheneOS just as you choose a new device when you're buying a new one. Soon there will be two different phone brands which you can install it on. There's already an estimated 500,000 users with Pixel exclusivity.

https://grapheneos.social/@GrapheneOS/117249893761790371

> GrapheneOS's goal is privacy for the world and that's achieved through secure devices.

Perfect is the enemy of good. What's better for privacy, an old but inexpensive smartphone running Android 11, or the same smartphone running an up-to-date third-party rebuild of Android 16 or newer with as many privacy-improving bells and whistles as the hardware can support?

> Soon there will be two different phone brands which you can install it on.

...will they be available in my country (Brazil)? I don't think I've ever seen a Google Pixel phone in person.

Are all of these unsuitable [0]?

Not sure if you have any experience with eBay. I looked it up and people had problems selling to Brazil [1] but there are various listings that offer to ship. So maybe not a great option.

KaBuM!, Intec Store, Performance Solutions all charge significantly more with a 10a being more than double than from Google.

Motorola officially sells the Signature in Brazil [2] at the same price or cheaper than in the UK. It will be supported by GrapheneOS in 2027 on the 2027 version. From then on, hopefully Qualcomm brings MTE to the non-flagship chips and Motorola and GrapheneOS support budget or midrange devices.

>perfect is the enemy of good

I don't consider that relevant when users deserve ≥ security than an iPhone. GrapheneOS is not purpose-built to avoid big-tech's services although it does that more completely than any other alternative mobile operating system, the focus is privacy.

GrapheneOS on the state of privacy and security for their ethos: https://x.com/GrapheneOS/status/2044440381803069778

[0] https://www.ebay.com/sch/i.html?_nkw=google+pixel+9

[1] https://reddit.com/r/Ebay/comments/1d92pyn/

https://community.ebay.com/forum/shipping-57923/topic/diffic...

[2] https://www.motorola.com.br/smartphone-motorola-signature/p?...

> Are all of these unsuitable [0]? [...] I looked it up and people had problems selling to Brazil [1] but there are various listings that offer to ship.

Do these phones have ANATEL certification? Because if they don't, they will be rejected by customs. It's not simply a case of the item being held until you pay a 60% import tax.

There are [1] people currently using GrapheneOS in Brazil. You can ask on the forum and you might get more clarity. The Motorola Signature will be announced in a few days but is a high end flagship with all-around better hardware than the Pixel 11 Pro XL and it's cheaper, but it's still a flagshio.

[1] https://discuss.grapheneos.org/?q=brazil%20

What's better for privacy, an old but inexpensive smartphone running Android 11, or the same smartphone running an up-to-date third-party rebuild of Android 16 or newer

I see your point, but it would be very misleading, since the phone would still have a lot of known holes. Only the OS would get updated, typically not the drivers, driver firmware, possibly not the kernel. The phone would still be easily compromised through all the known RCEs. So you tie up non-profit projects in a lot of extra work to get an improvement that does not really matter.

This is a mess created by the OEMs and they will continue to create this mess until people will stop buying from OEMs that only give lip service to security updates (roll out Android Security Bulletins to show a high patch level, while in reality the phone the phone has many known CVEs).

Android Security Bulletins do list a tiny subset of firmware, Linux kernel, driver and HAL patches so they do require at least very minimal updates to those. Most non-Google-certified operating systems are setting an inaccurate Android security patch level by ignoring the non-AOSP portion of the patches. GrapheneOS doesn't do that but most of the other AOSP-based projects not being certified by Google are doing it. OEMs were caught doing it too but it's not clear if it was intentional in most cases as it is with the alternate operating systems.

Android Security Bulletins set a very low bar since the AOSP patches are available to ship by OEMs 2-6 months prior to the bulletin being published. It's also only High/Critical severity patches being listed. Due to a recent policy change, it's also officially only a subset of the patches for AOSP. That's visible through the Android platform components having patches in the Pixel Update Bulletin for September 2026 despite those being applicable to other operating systems. It's because they no longer want to backport all High and Critical severity patches due to the high volume of issues discovered by AI models. It's similar to how they stopped backporting any Low and Moderate severity patches years ago due to high volume.

The purpose of GrapheneOS isn't providing a less bad operating system for insecure devices which still lacks anything close to reasonable security patches and protections. It would not be possible to provide the core GrapheneOS feature set on those devices. More importantly, they'd have many years of missing firmware, kernel, driver and HAL updates. Those are among the most important security updates and would not be available in practice. That would not be GrapheneOS and is not the purpose of GrapheneOS.

You can dot his but it won't be Graphene but something else, like LineageOS. As long as Graphene's selling point is extreme privacy and not just more privacy, it will be this way.

There is no such thing as extreme privacy; it isn't something any phone can provide, especially if you are going to rely on third party software and services like email and instant messengers where the likes of Google and Facebook are dominant players. Even behind a VPN, Vanadium is fingerprintable by commercial trackers like fingerprint.com. Short of disabling Javascript, browsers leak enough information to basically follow anyone around the internet.

How much do you know about Graphene? It literally disables JavaScript JIT for security.

> How much do you know about Graphene?

Enough to know that it is as fingerprintable as any other phone. Disabling Javascript JIT will not change that.

Same thing here, I use Graphene for the sake of user control. All the security features and hardening of the Pixel phones and of the OS are good to have, but they not the main reason.

What if GrapheneOS believe that privacy/security is what gives users real abuse-resistant agency and control over what happens on their device with their data?

I just ran https://github.com/CakesTwix/Android-CVE-2026-43499 on my Pixel 9 Pro and it seems to have been patched. I did get a system update not long ago, though.

Try https://github.com/alex193a/Root-My-Pixel, worked on my 9a as of a few days ago (the version table in the readme is stale). I haven't checked the September update yet though (installing it now, to check).

Edit: September update for 8a has a kernel build from July. I believe it's still vulnerable but the exploit will need its offsets adjusting etc.

There's "dropping the ball" and then there's "not reaching out your glove to catch it to begin with".

It'd be interesting to see which one is happening here.

Reply on news.ycombinator.com