• Do you Play DayZ, World of Tanks or STO? Why not visit our Partner website The Good Stuff Clan and join the gaming goodness they have to offer, click here to join their discord

Mobile GrapheneOS


Dec 25, 2019
Reaction score
DS Credits
GrapheneOS is an open source privacy and security focused mobile OS with Android app compatibility. It's focused on the research and development of privacy and security technology including substantial improvements to sandboxing, exploit mitigations and the permission model. GrapheneOS also develops various apps and services with a focus on privacy and security. Vanadium is a hardened variant of the Chromium browser and WebView specifically built for GrapheneOS. We also have a minimal security-focused PDF Viewer, our hardware-based Auditor app / attestation service providing local and remote verification of devices and the externally developed Seedvault encrypted backup which was initially developed for inclusion in GrapheneOS is integrated.

Releases: GrapheneOS releases
Install: GrapheneOS install documentation
Source: GrapheneOS source


GrapheneOS is a collaborative open source project, not a company. It's used and supported by a variety of companies and other organizations. It won't be closely tied to any company in particular. There will eventually be a non-profit GrapheneOS foundation, but for now the developers represent the project.

GrapheneOS improves the privacy and security of the OS from the bottom up. It has a hardened kernel, libc, malloc and compiler toolchain with many low-level improvements. These changes are designed to eliminate whole classes of serious vulnerabilities or provide meaningful barriers to exploitation. We avoid making changes without a clear rationale and we regularly work towards simplifying and replacing these low-level improvements. The malloc implementation is our own hardened_malloc providing cutting edge security for modern systems. The hardened_malloc project is portable to other Linux-based operating systems and is being adopted by other security-focused operating systems like Whonix. The hardened_malloc README has extensive documentation on it. Our work also heavily influenced the design of the next-generation musl malloc implementation which offers substantially better security than musl's previous malloc while still having minimal memory usage and code size.

There are also many under-the-hood changes at a higher level, including major improvements to SELinux policies particularly for the app sandbox. GrapheneOS tries to avoid impacting the user experience with the privacy and security features. Ideally, the features can be designed so that they're always enabled with no impact on the user experience and no additional complexity like configuration options. It's not always feasible, and GrapheneOS does add various toggles for features like the Network permission, Sensors permission, restrictions when the device is locked (USB peripherals, camera, quick tiles), etc. along with more complex user-facing privacy and security features with their own UX.

GrapheneOS has made substantial contributions to the privacy and security of the Android Open Source Project, along with contributions to the Linux kernel, LLVM, OpenBSD and other projects. Much of our past work is no longer part of the downstream GrapheneOS project because we've successfully landed many patches upstream. We've had even more success with making suggestions and participating in design discussions to steer things in the direction we want. Many upstream changes in AOSP such as removing app access to low-level process, network, timing and profiling information originated in the GrapheneOS project. The needs of the upstream projects are often different from ours, so they'll often reimplement the features in a more flexible way. We've almost always been able to move to using the upstream features and even when we still need our our implementation it helps to have the concepts/restrictions considered by the upstream project and apps needing to be compatible with it. Getting features upstream often leads to an improved user experience and app compatibility.

Official releases are available on the releases page and installation instructions are on the install page.


The official GrapheneOS releases are supported by our Auditor app and attestation service. The Auditor app and attestation service provide strong hardware-based verification of the authenticity and integrity of the firmware/software on the device. A strong pairing-based approach is used which also provides verification of the device's identity based on the hardware backed key generated for each pairing. Software-based checks are layered on top with trust securely chained from the hardware. For more details, see the about page and tutorial. These also support other operating systems.

No Google apps or services
GrapheneOS will never include either Google Play Services or another implementation of Google services like microG. Those are not part of the Android Open Source Project and are not required for baseline Android compatibility. Apps designed to run on Android rather than only Android with bundled Google apps and services already work on GrapheneOS, so a huge number of both open and closed source apps are already available for it.

Open APIs not tied to Google will continue to be implemented using open source providers like the Seedvault backup app. Text-to-speech, voice-to-text, non-GPS-based location services, geocoding, accessibility services, etc. are examples of other open Android APIs where we need to develop/bundle an implementation based on existing open source projects. Compatibility with apps depending on Google APIs / services will be improved by implementing them in a way that pretends Google has stopped existing and the servers are unavailable.


Changelog: GrapheneOS releases

Github: GrapheneOS
AdBlock Detected

We get it, advertisements are annoying!

Sure, ad-blocking software does a great job at blocking ads, but it also blocks useful features of our website. For the best site experience please disable your AdBlocker.

I've Disabled AdBlock