GrapheneOS Accuses Google of Withholding 17 Android APIs, Extending Pixel Security Lead
Updated
Updated · It's FOSS · Sep 18
GrapheneOS Accuses Google of Withholding 17 Android APIs, Extending Pixel Security Lead
1 articles · Updated · It's FOSS · Sep 18
Summary
GrapheneOS said Google’s September 2026 Pixel bulletin includes platform-level Android patches that non-Pixel manufacturers still cannot access through the regular security bulletin or preview channels.
Those fixes may not reach other OEMs until Android 17 QPR2 in December, which GrapheneOS says effectively gives Pixel devices a months-long security advantage.
Android 17 QPR1 also introduced 1 new package and changes across 16 existing API packages that were not published to AOSP, a break GrapheneOS says has not happened since Honeycomb.
GrapheneOS said it ported its code to QPR1 before release but cannot ship it, and is instead backporting Pixel firmware, kernel drivers, userspace drivers and HALs onto Android 17.
The project also cited a GPL compliance delay—sources for build CD1A.260905.001.A1 arrived more than two weeks after a Sept. 1 request—as part of a broader pattern of tightening Google control over Android.