The issue is assigned CVE-2026-58882, has Critical severity and is part of the November 2026 security patch level. OEMs received the patch in July 2026 and have been allowed to ship it since then. That's how the patch…
Google committed a fix on June 15th and it was shipped in the security preview patches in mid-July. GrapheneOS shipped it in our security preview releases in July. It's in the upcoming November security bulletin but a…
It's ludicrous to claim software with signed releases isn't open source. Having private keys used to generate the signatures for APKs, updates and the vbmeta image doesn't somehow make it not open source. Every APK is…
Software doesn't stop being open source because the releases are signed to be able to verify those. Any OS can be installed on the supported device. The verified boot key hash shown at boot will be different for an…
GrapheneOS is open source with reproducible builds. Android key attestation isn't specific to GrapheneOS and is OS independent. It mainly exists to check that a key was generated in a hardware keystore. There's no pass…
LineageOS doesn't keep up with very important standard privacy/security patches and protections. This post is a clear example where it took until October 2026 to ship crucial privacy/security patches and protections…
There will be both the option to install GrapheneOS on a device sold without it and to buy a device with it preinstalled. Devices sold with it preinstalled are coming after the initial launch of support. Details cannot…
Permissively licensed open source code is open source code. Firmware on a secure element can be open source without it being possible to replace it without the signing key on a production device.
We try to convince them not to do it at all, but if they insist on doing it then we point them to our signed list of verified boot key fingerprints and Google's library for key attestation verification. We have a page…
Yes, we very actively engaged in discussion with the EU Commission. It hasn't resulted in any major actions against Google in this area yet. The people we've talked to seem to understand what we've told them but it's…
Our point is that GrapheneOS will be an officially supported OS on Motorola devices and will be sold with it officially installed but will still be banned. It's likely it can have green verified boot state eventually…
We're in contact with people at Revolut since after we posted about it and think it's going to keep working on GrapheneOS now. It remains to be seen.
https://x.com/search?q=from%3A%40grapheneos%20play%20integri... Many of our posts about it heavily criticize apps limiting which operating systems and hardware can be used in addition to the Play Integrity API itself.
Revolut currently works on GrapheneOS though.
We plan on having improved compatibility with banking and government apps rather than most banning using GrapheneOS. Those apps aren't banning it for any actual reason. We don't have to convince them to stop doing what…
Providing root access to a huge portion of the OS with a way for apps to obtain it goes against the privacy and security focus. It's never a reasonable way to implement the features provided by those kinds of apps. It's…
Certain MDM apps support using the Play Integrity API to ban using non-Google-certified devices. Some MDM apps simply don't know how to successfully create a functional work profile without Google Play being…
It isn't clear what your response is referring to.
Their main concern is malware not capable of exploiting OS vulnerabilities. They focus on protecting against malicious clones or modifications of their apps along with enforcing having a mandatory app sandbox and not…
Basic integrity requires being logged into an account. You can create a throwaway account and you'll pass. You may need a VoIP number if you're using a VPN to meet the phone number requirement for IPs without a good…
GrapheneOS will have official support on multiple devices from Motorola and will likely eventually have green verified boot state on the subset of their devices with support for it. This won't help with the Play…
The issue is assigned CVE-2026-58882, has Critical severity and is part of the November 2026 security patch level. OEMs received the patch in July 2026 and have been allowed to ship it since then. That's how the patch…
Google committed a fix on June 15th and it was shipped in the security preview patches in mid-July. GrapheneOS shipped it in our security preview releases in July. It's in the upcoming November security bulletin but a…
Google committed a fix on June 15th and it was shipped in the security preview patches in mid-July. GrapheneOS shipped it in our security preview releases in July. It's in the upcoming November security bulletin but a…
Google committed a fix on June 15th and it was shipped in the security preview patches in mid-July. GrapheneOS shipped it in our security preview releases in July. It's in the upcoming November security bulletin but a…
Google committed a fix on June 15th and it was shipped in the security preview patches in mid-July. GrapheneOS shipped it in our security preview releases in July. It's in the upcoming November security bulletin but a…
Google committed a fix on June 15th and it was shipped in the security preview patches in mid-July. GrapheneOS shipped it in our security preview releases in July. It's in the upcoming November security bulletin but a…
It's ludicrous to claim software with signed releases isn't open source. Having private keys used to generate the signatures for APKs, updates and the vbmeta image doesn't somehow make it not open source. Every APK is…
Software doesn't stop being open source because the releases are signed to be able to verify those. Any OS can be installed on the supported device. The verified boot key hash shown at boot will be different for an…
GrapheneOS is open source with reproducible builds. Android key attestation isn't specific to GrapheneOS and is OS independent. It mainly exists to check that a key was generated in a hardware keystore. There's no pass…
LineageOS doesn't keep up with very important standard privacy/security patches and protections. This post is a clear example where it took until October 2026 to ship crucial privacy/security patches and protections…
There will be both the option to install GrapheneOS on a device sold without it and to buy a device with it preinstalled. Devices sold with it preinstalled are coming after the initial launch of support. Details cannot…
Permissively licensed open source code is open source code. Firmware on a secure element can be open source without it being possible to replace it without the signing key on a production device.
We try to convince them not to do it at all, but if they insist on doing it then we point them to our signed list of verified boot key fingerprints and Google's library for key attestation verification. We have a page…
Yes, we very actively engaged in discussion with the EU Commission. It hasn't resulted in any major actions against Google in this area yet. The people we've talked to seem to understand what we've told them but it's…
Our point is that GrapheneOS will be an officially supported OS on Motorola devices and will be sold with it officially installed but will still be banned. It's likely it can have green verified boot state eventually…
We're in contact with people at Revolut since after we posted about it and think it's going to keep working on GrapheneOS now. It remains to be seen.
https://x.com/search?q=from%3A%40grapheneos%20play%20integri... Many of our posts about it heavily criticize apps limiting which operating systems and hardware can be used in addition to the Play Integrity API itself.
Revolut currently works on GrapheneOS though.
We plan on having improved compatibility with banking and government apps rather than most banning using GrapheneOS. Those apps aren't banning it for any actual reason. We don't have to convince them to stop doing what…
Providing root access to a huge portion of the OS with a way for apps to obtain it goes against the privacy and security focus. It's never a reasonable way to implement the features provided by those kinds of apps. It's…
Certain MDM apps support using the Play Integrity API to ban using non-Google-certified devices. Some MDM apps simply don't know how to successfully create a functional work profile without Google Play being…
It isn't clear what your response is referring to.
Their main concern is malware not capable of exploiting OS vulnerabilities. They focus on protecting against malicious clones or modifications of their apps along with enforcing having a mandatory app sandbox and not…
Basic integrity requires being logged into an account. You can create a throwaway account and you'll pass. You may need a VoIP number if you're using a VPN to meet the phone number requirement for IPs without a good…
GrapheneOS will have official support on multiple devices from Motorola and will likely eventually have green verified boot state on the subset of their devices with support for it. This won't help with the Play…