GrapheneOS Accuses Google of Withholding Android Security Patches From Rival Manufacturers
The open-source Android fork claims Google is delaying critical platform-level security fixes and new APIs from reaching other device makers, a pattern that raises concerns about competitive fairness in the Android ecosystem.
Google's September 2026 Pixel Update Bulletin includes security patches that do not appear in the standard Android Security Bulletin released that same month, according to GrapheneOS. The project contends that several of these additional patches modify core Android platform code—the foundation that powers devices beyond Google's own Pixel line—yet this code remains unavailable to other manufacturers.
Other device makers typically access private preview patches to prepare their own security updates, but these platform-level fixes have not been shared through those channels either. GrapheneOS estimates that non-Pixel original equipment manufacturers will not receive this code until Android 17 QPR2 launches in December, a delay of several months.
The project describes the situation as Google "gatekeeping security patches to the standard Android platform code from Android OEMs."
The complaints
GrapheneOS points to a separate concern: Android 17 QPR1 introduced new developer APIs that never reached the Android Open Source Project (AOSP). The project says this marks the first time such an occurrence has happened since the Honeycomb era of Android.
Google's own API diff report confirms the discrepancy. A comparison between Android 17 and QPR1 reveals one entirely new package, android.hardware.hid, alongside modifications spanning sixteen other packages, including android.media, android.os, android.provider, android.telecom, and android.view.
GrapheneOS has already ported its implementation to QPR1 before Google made the release public, yet lacks authorization to distribute that work. The project is now working around the restriction by backporting Pixel firmware, kernel drivers, userspace drivers, and HALs from QPR1 to Android 17.
A third issue compounds the tension: compliance with open-source licensing obligations. GrapheneOS requested source code for a specific build (CD1A.260905.001.A1) on September 1, but Google did not grant access until more than two weeks had passed.
Why this is worrying
Each of these three problems—a three-month security patch delay, a pause on API distribution, a two-week lag in GPL compliance—could individually be dismissed as an isolated incident. Collectively, however, they suggest a pattern in which Google is restricting security updates from the broader Android ecosystem, preventing new APIs from entering AOSP for the first time in over a decade, and moving slowly on open-source licensing requirements it is legally bound to fulfill.
The concerns extend beyond security patches. Google is moving toward a requirement that every Android app developer—whether publishing to the Play Store, F-Droid, or elsewhere—register with the company. Starting in 2027, developers will need to provide legal identification and cryptographic key evidence before their applications can run on any certified device.
Installing an unverified app outside this system would require users to enable developer settings, observe a mandatory 24-hour waiting period, and dismiss multiple warning dialogs.
GrapheneOS joined dozens of other organizations in signing the Keep Android Open campaign to oppose this direction. The coalition includes F-Droid, the Electronic Frontier Foundation, and the Free Software Foundation.