I was secretly hoping they'd stop supporting the Pixel 4a so I would have a reason to get a new phone, but no, still there in the list of supported devices. So I guess I'll just keep using that thing another year... Anyway: big thanks to the Lineage maintainers, keeping so many phones from landfill!
If you need a reason, the modem and the baseband firmware have several unpatched vulnerabilities on that model, which is not something that an Android update can resolve.
Based on the amount of modem CVEs posted in the monthly Android security bulletins, I think it's safe to assume that if you are no longer getting updates then there are unpatched vulnerabilities in them.
Based on the artificial delays Google introduces into the Android patching process, on the general crappiness of mobile firmware and the sleaziness of major mobile chipset vendors, I think it's safe to assume that even if you are supposedly getting updates, there are unpatched zero-day vulnerabilities in them. Usually under ongoing attack, at least by professional phone cracking software vendors and secret services.
>Based on the artificial delays Google introduces into the Android patching process, on the general crappiness of mobile firmware and the sleaziness of major mobile chipset vendors, I think it's safe to assume that even if you are supposedly getting updates, there are unpatched zero-day vulnerabilities in them.
Maybe if you include third party android OEMs like samsung, but google pixels are as up to date as you can get.
Pixels running GrapheneOS sure, but stock Pixels lag months behind patches that exist but not yet shipped. Check any bulletin and it links to git commits to months ago.
>Check any bulletin and it links to git commits to months ago.
Is there any evidence that the git commits weren't in the ROMs from months ago? The monthly ASB corresponds to when the bugs are publicly disclosed, not when they made it into ROMs.
Pixels only ship a tiny subset of the security preview patches early. Samsung ships a subset for their flagship devices too and it's likely larger than Pixels. Samsung lists these patches in their bulletins and you can retroactively figure out which were future Android Security Bulletin patches. Go through the vulnerabilities for September 2026 or October 2026 and search for them in Samsung's bulletin.
The only way to get the full set of security preview patches is through GrapheneOS. It's strange Google doesn't ship more for the Pixel OS but that's the way it is right now. It takes them around 4 weeks to make a release and even longer when including the time for adding changes to it so there's a long delay built into the process. They should fix it but are clearly not prioritizing it without media pressure that's not happening. They do a lot better than other OEMs but that's much different from doing a good job.
Android Security Bulletins don't list the vast majority of firmware, driver, HAL and especially Linux kernel vulnerabilities. Those list a large subset of the High and Critical severity Android Open Source Project (AOSP) vulnerabilities backported to older releases along with a tiny portion of non-AOSP vulnerabilities. AOSP vulnerabilities below High and Critical severity aren't backported so those aren't listed. Non-AOSP vulnerabilities for Pixels are covered in the Pixel Update Bulletins with many of those being vulnerabilities in components used by other devices. Each OEM is supposed to make their own equivalent to the Pixel Update Bulletins, but they aren't required to provide those updates to claim the latest patch level.
They patched CVE-2026-43499 even for out of support kernels[1] so that's something. The bigger problem is CVEs in proprietary components (drivers, blobs, firmware).
It's very misleading since the vast majority of serious Linux kernel vulnerabilities aren't patched for these end-of-life devices. That vulnerability patched due to media coverage based on their policy to do so. It's no more severe than many of the unpatched ones.
That's very misleading since the vast majority of serious Linux kernel vulnerabilities aren't patched for these end-of-life devices. That vulnerability patched due to media coverage based on their policy to do so. It's no more severe than many of the unpatched ones.
The vast majority of kernel vulnerabilities aren't backported to end-of-life devices. Special cases are made for certain vulnerabilities with a lot of media coverage. Firmware, kernel drivers, userspace drivers and HALs on end-of-life devices go without patches in general.
I too have a 4a that is still ticking thanks to Lineage!
The only problem I've discovered is that group texts sometimes don't work (I can't see others' replies or worst case I don't receive the group text at all). Not sure if anyone else has run into this, seems like it could be related to RCS and unlocked bootloader not playing nice.
I have stock Android on a Pixel 10 and RCS group texts don't work here either. Some people just can't be added to the group and some people just don't receive the texts.
I flashed my 10 with Graphene as soon as it was supported and RCS was a bit of a challange as well. Both because of the recipient's device/settings as well as my own privacy settings.
What happened there, ... After official support by Google for the 4a stopped, I remember checking LOS out, and found that it wasn't supported there either. Did I hallucinate that, or did LOS resume support afterwards? Or maybe I'm mixing up LOS and graphene
I was secretly hoping I didn't misread and Linaro wiki would be up again, I really wish we could just install mainline linux on those Android phones...
I flashed my 4XL today (from the no longer supported Graphene). It's nice to be able to keep a 7 year old device runnin, when most people bin theirs after 3-4 years.
I second this. I've been using Lineage on older, second-hand OnePlus phones for about a decade now, currently a OnePlus 8T. You can pick them up pretty cheaply from eBay, and they're solid devices, often in near-new condition. Pair them with Lineage, and you're golden.
That might be coming to an end, though, if OnePlus no longer allows bootloader unlocking.
Absolutely love this project for keeping my OnePlus 6T alive.
Such sad state of affairs for Android. They dropped the ball on making any working edge deep learning inference framework. iOS is way better at this of all things. For being an OSS platform the amount of rigidity in not letting users customize to the fullest without rooting is just tragic.
SDM845 has increasing support in mainline Linux, but the current official LineageOS builds still rely on the vendor-provided kernel, which is why that is still listed on the wiki.
Just see out of touch with reality this section is compared to the insanse community work on Apple Silicon across whisper.cpp/mflux/llama.cpp/MLX/Exo & way more
Would be interesting for x86-based tablets/convertibles, like for instance an old Lenovo X1. I tried using these with Linux with various different distributions, including PostmarketOS, and it was not a good experience.
Better sandboxing. If one of the programs you apt-get is hacked through supply chain compromise or something, it has full access to all the goodies in your user profile. There are distros that attempt to implement sandboxing but in those distros your browser can't really be jailed properly. Qubes has tighter isolation than android does, but is slower and too much of a hassle for your typical employee or relative.
Android is pretty slick overall and the user experience is simpler and more familiar to people than Windows or Linux (even if they're an iPhone user). You'd be surprised how many people don't really use PCs.
GrapheneOS actually feels just like LineageOS, except that it has faster upstream updates, better security, and greater usability...
I don't understand why it took LineageOS so long to update to AOSP 17, while GrapheneOS managed to update to 17 in just 3 days. LineageOS really should be based directly on GrapheneOS.
> I don't understand why it took LineageOS so long to update to AOSP 17, while GrapheneOS managed to update to 17 in just 3 days.
Here's a hint: GrapheneOS has paid developers working on it full-time, while LineageOS is done by people in their spare time. Also, GrapheneOS has a collaboration with Motorola and through that gets for instance early access to security patches, and probably other things as well. And lastly, LineageOS supports roughly 10x the number of devices. It's significantly easier if you restrict yourself to Pixels.
Also, GrapheneOS has a collaboration with Motorola and through that gets for instance early access to security patches, and probably other things as well.
Just for clarification (your points are very valid): the GrapheneOS developers have stated on several occasions that they getting embargoed patches from another OEM than Motorola.
GrapheneOS doesn't receive early access to security patches via Motorola. We receive those through a different partner. We were already doing security preview releases prior to them giving us access to their repositories which do not contain those.
I’m not sure that as a casual user that this fact would bother me very much, especially the kind of user who is using LineageOS as an alternative to replacing an old phone that has lost software support entirely. Getting security updates on a 3 month lag is a lot better than not getting them at all.
I also think amount of times a 3 month lag would have any significant likelihood of affecting me personally with an active exploit seems low.
A lot of CVEs don’t have widespread active exploits and a lot of threat actors aren’t sufficiently motivated. A lot of exploits require the user to interact with something sketchy or for the attacker to have a specific reason to target you.
Pixels provide the same security features and updates for the budget 'a' series devices as the regular ones. Pixel 8a is one of the recommended devices for GrapheneOS since it still meets all the current era security standards and still has over 4.5 years of updates remaining despite being 3 generations old due to starting with 7 and launching after the initial set of 8th gen devices.
Motorola will be working towards providing the same thing as part of our partnership with them, but we're starting out with the high end flagship devices due to those currently being required for it.
GrapheneOS doesn't receive early access to security patches via Motorola. We receive those through a different partner. We were already doing security preview releases prior to them giving us access to their repositories which do not contain those.
While not great, a private space or work profile with Shelter can work in a a pinch. I use it e.g. WhatsApp, where I just need three people, but which is almost unusable if you don’t give it the permission.
It’s a bit more annoying but also isolates stuff like photos etc. by default, so you don’t have to think about it.
What a weird take. I see it the other way round: if you can run GrapheneOS, run GrapheneOS, period. If you can't, then there is a really cool project called LineageOS that you probably can run, and you should look into it :-).
It's not quite that simple. I don't use GOS because GOS and I have mutually incompatible views of user control. I prefer that I control my phone, they say I can't be trusted with that.
That's an inaccurate portrayal of our approach and especially how it compares to LineageOS. LineageOS does not provide app or user accessible root accessible either. As a counterexample to your narrative, GrapheneOS provides full manual and automatic call recording functionality internationally while LineageOS restricts it based on region.
It's really not; you've argued extensively with me that the moment a user can run an app with root the whole system is insecure. LOS sadly doesn't ship anything but `adb root` by default (although... they do that, so yes they do ship "user accessible root"), but they're still less hostile about it.
Anyways, since you're here perhaps you can answer my question from the other subthread: If I flash GOS and then flash Magisk on it, how hard is it to stay unbricked? Is it as easy as declining to relock the bootloader once, or is the system going to actively fight me on every boot?
Yes this is probably a good summary. If you have a fairly recent Pixel, there is probably no reason to pick Lineage over Graphene. But Lineage covers far more devices and device types, including ancient ones.
Contact Scopes and Storage Scopes are a small subset of the privacy features provided by GrapheneOS. It's also adding major privacy improvements on a regular basis including the recently added secure paste feature and ongoing fixes for upstream Android VPN leaks. There are many other privacy features beyond those.
Privacy heavily depends on security. GrapheneOS greatly improves both privacy/security patches and privacy/security protections. The sole reason for the focus on security in GrapheneOS is because it's a privacy project. It has no other reason to work on security.
Android 17 was released in June 2026 and has been required for full standard Android privacy and security patches since then. Only a subset of the patches Google deems to be High or Critical severity are backported. Keeping up with the standard backports and major updates is important but increasingly inadequate.
I'm definitely open to trading some security/privacy features in favour of some QoL features Lineage had last time I used it - moving the clock back to the right (where persistent notifications belong) and power button for flashlight. It's a shame this has to be a "or" but as I use a burner phone when crossing borders anyway...
It can be complicated. I don’t remember the whole story, but I think on the older Xperias you’d have to take care to reinstall the proprietary drivers and there were keys that could be permanently lost and then you’d be out of some of the enhancements.
Are there good guides for getting started with adding support for a device? I doubt I have time but making ROMs and figuring out bootloader unlocks are things I've always been intrigued by but have always seemed like black magic to me.
Just trying to understand why that's a mystery :thinking_face:
Who do you think "you guys" is exactly? You guys is you. You can port it to your chosen device and be the maintainer for that device and then we can thinking face wonder why you didn't give us some other device we wish was supported.
I am not sure, but here is my take on cars and smart phones: don't. Cars already spy on users through their onboard cellular modem. The last thing that you want is BMW or some or carmaker accessing, in addition to that, data on your phone, or using to exfiltrate data if you removed/disabled the car's cellular modem.
I wish Lineage did a better job at explaining which new devices are supported. Lineage clearly supports a lot of devices and device types, but most are ancient or specific models with a known hack to unlock the bootloader. A short list of recommended devices in each category (phone, TV, tablet), that can be bought new today, would go a long way.
Not a lot of them unfortunately.. but with current bootloader unlocking situation, only newer motorolas seem to be missing... OnePlus 15 was added (or is in the making)
GrapheneOS has support for all non-end-of-life Pixels including the budget 'a' series which are available at low prices for new devices. We don't continue indefinitely supporting devices lacking updates to firmware, drivers, HALs and in practice also upstream kernel updates once those become unreasonably insecure. We do provide extended support past end-of-life but we stop once we believe it's doing more harm than good by encouraging people to use insecure devices and especially to buy those to use it against our advice. It's a privacy and security project so we can't reasonably have official support for devices where it's highly insecure.
I have LineageOS installed on my Moto G7 Power (Ocean) phone, and the GPS places me somewhere like 100 feet north of where I actually am, making navigation useless. I wish I could recommend aftermarket operating systems once the manufacture abandons the device, but this is something serious enough to warrant throwing the phone away.
110 comments
[ 4.2 ms ] story [ 21.5 ms ] threadMaybe if you include third party android OEMs like samsung, but google pixels are as up to date as you can get.
Is there any evidence that the git commits weren't in the ROMs from months ago? The monthly ASB corresponds to when the bugs are publicly disclosed, not when they made it into ROMs.
The only way to get the full set of security preview patches is through GrapheneOS. It's strange Google doesn't ship more for the Pixel OS but that's the way it is right now. It takes them around 4 weeks to make a release and even longer when including the time for adding changes to it so there's a long delay built into the process. They should fix it but are clearly not prioritizing it without media pressure that's not happening. They do a lot better than other OEMs but that's much different from doing a good job.
BRB gonna try this out on my old Fairphone
Anyway, obvious clear reason why firmware signature gating should be illegal.
[1] eg. https://review.lineageos.org/q/b309b56b8cca20dcf6f678777d3ac...
The only problem I've discovered is that group texts sometimes don't work (I can't see others' replies or worst case I don't receive the group text at all). Not sure if anyone else has run into this, seems like it could be related to RCS and unlocked bootloader not playing nice.
It's so bad.
That might be coming to an end, though, if OnePlus no longer allows bootloader unlocking.
Such sad state of affairs for Android. They dropped the ball on making any working edge deep learning inference framework. iOS is way better at this of all things. For being an OSS platform the amount of rigidity in not letting users customize to the fullest without rooting is just tragic.
Are you running unofficial builds right now ?
What even is there in Android 17 to talk about, same old UI, no non-google AI features to run on-device without root
Source? Lineageos lists kernel version as 4.9, which definitely isn't "mainline".
https://wiki.lineageos.org/devices/enchilada/
Just see out of touch with reality this section is compared to the insanse community work on Apple Silicon across whisper.cpp/mflux/llama.cpp/MLX/Exo & way more
Android phones didn't need "insane community work" because (unlike Apple hardware) they support the same Vulkan compute shaders that PC GPUs use.
Apple Silicon of all things beat them to it over COVID, Tensorflow is a relic in the ML community altogether already
>While it’s still in experimental state, it has successfully booted on:
>Common x86_64 PCs
>Apple Silicon Macs
>NVIDIA DGX Spark
>Qualcomm Snapdragon X Series Laptops
That actually sounds awesome! Refurbishing old laptops with Android would be a nice choice alongside with Desktop Linux.
Android is pretty slick overall and the user experience is simpler and more familiar to people than Windows or Linux (even if they're an iPhone user). You'd be surprised how many people don't really use PCs.
I don't understand why it took LineageOS so long to update to AOSP 17, while GrapheneOS managed to update to 17 in just 3 days. LineageOS really should be based directly on GrapheneOS.
GrapheneOS does not have circle battery.
> LineageOS really should be based directly on GrapheneOS.
What would that achieve?
Here's a hint: GrapheneOS has paid developers working on it full-time, while LineageOS is done by people in their spare time. Also, GrapheneOS has a collaboration with Motorola and through that gets for instance early access to security patches, and probably other things as well. And lastly, LineageOS supports roughly 10x the number of devices. It's significantly easier if you restrict yourself to Pixels.
Just for clarification (your points are very valid): the GrapheneOS developers have stated on several occasions that they getting embargoed patches from another OEM than Motorola.
A sufficiently motivated threat actor will have them (the exploits) too.
I also think amount of times a 3 month lag would have any significant likelihood of affecting me personally with an active exploit seems low.
A lot of CVEs don’t have widespread active exploits and a lot of threat actors aren’t sufficiently motivated. A lot of exploits require the user to interact with something sketchy or for the attacker to have a specific reason to target you.
Motorola will be working towards providing the same thing as part of our partnership with them, but we're starting out with the high end flagship devices due to those currently being required for it.
It’s a bit more annoying but also isolates stuff like photos etc. by default, so you don’t have to think about it.
Anyways, since you're here perhaps you can answer my question from the other subthread: If I flash GOS and then flash Magisk on it, how hard is it to stay unbricked? Is it as easy as declining to relock the bootloader once, or is the system going to actively fight me on every boot?
- secure app spawning (huge because without it, many hardening improvements are useless)
- extremely secure memory allocator
- fully enabled MTE on shiba and newer
- relockable bootloader
- stronger forensics resistance
- more trustworthy developers (ever heard of LOSCoins?)
- rapid support for new Pixels
- lightning fast security updates faster than most OEMs/ODMs
- built-in TTS without GMS
- real GMS that isn't priv-app
and so much more
Privacy heavily depends on security. GrapheneOS greatly improves both privacy/security patches and privacy/security protections. The sole reason for the focus on security in GrapheneOS is because it's a privacy project. It has no other reason to work on security.
Android 17 was released in June 2026 and has been required for full standard Android privacy and security patches since then. Only a subset of the patches Google deems to be High or Critical severity are backported. Keeping up with the standard backports and major updates is important but increasingly inadequate.
Or even to AOSP: https://source.android.com/docs/setup/contribute/submit-patc...
Is this still the case? My guess is that Lineage doesn't get the drivers necessary for better quality maybe.
Just trying to understand why that's a mystery :thinking_face:
Who do you think "you guys" is exactly? You guys is you. You can port it to your chosen device and be the maintainer for that device and then we can thinking face wonder why you didn't give us some other device we wish was supported.
Not a lot of them unfortunately.. but with current bootloader unlocking situation, only newer motorolas seem to be missing... OnePlus 15 was added (or is in the making)
A bargain for a test device or a daily driver for the not so wealthy.
You want to change something? Want to be recognized for making anything better?
Port it on sub $200 devices.
That's where the masses are.
That's where you start the degoogle revolution. Where you can build a sustainable business.
Did you even check the device list? Half of the chinese models are $200 or less. It's never been a price question
The device that I am typing this on (which runs LineageOS) cost me around $170 new.