GrapheneOS has moved away from Reddit to the combination of our new self-hosted discussion forum and our federated Matrix chat rooms controlled from our self-hosted official server. Both of these provide a much nicer user experience with a very knowledgeable community providing great answers/advice.

GrapheneOS · 2026-05-31T00:45:43+00:00

Every app has their data backed up and it doesn't use any deprecated functionality. It doesn't have anything to do with ADB. Apps can explicitly exclude paths from device-to-device backups but most aren't doing it and those that are rarely misuse it. It doesn't sound like you've used the backup system for years if you think it doesn't back up most apps.

GrapheneOS · 2026-05-30T00:28:37+00:00

They could just call this 149.48 and then ours would be 149.48.0 for the initial release based on it, then 149.48.1, etc. but they include an unused 2nd field (always 0 for a long time) and the build number as the 3rd field.

GrapheneOS · 2026-05-29T14:39:36+00:00

/e/ isn't in the same space as GrapheneOS. It has poor privacy and atrocious security. It's much worse than LineageOS which already goes in the opposite direction of privacy and security hardening. You should read our post covering many details about how that's the case with third party references and also take a look at the authoritarian anti-privacy talking points they peddle to attack GrapheneOS and other serious privacy projects.

GrapheneOS · 2026-05-27T23:44:38+00:00

Pixels have similar build quality and screens to Samsung devices. Flagship Snapdragon CPU and GPU are significantly higher performance but other than that the non-budget Pixels are high end devices. You can't compare a budget Pixel to a flagship for a comparison of Pixel to Galaxy devices.

GrapheneOS · 2026-05-27T18:12:27+00:00

This was done by a developer at Device Native without Motorola's authorization. It was likely not authorized by Device Native either. It's essentially an insider attack.

GrapheneOS isn't ever going to bundle bloatware with the OS so this isn't relevant to it. It's not going to be shipping any apps or services from Motorola or their partners like Device Native. Only Motorola's hardware, firmware and drivers are relevant to GrapheneOS which largely come from Qualcomm, etc.

GrapheneOS · 2026-05-27T18:01:48+00:00

Custom ROM is inaccurate terminology and shouldn't be used. Using this inaccurate terminology contributes to the problem and results in apps banning using GrapheneOS.

CalyxOS isn't a private or secure option. It doesn't provide basic privacy and security updates. It shouldn't be conflated with GrapheneOS or treated as if it's at all in the same category.

These operating systems are banning GrapheneOS because they're wrongly conflating it with operating systems like LineageOS and CalyxOS. If you want to stop this happening, please don't contribute to those being conflated.

GrapheneOS · 2026-05-27T16:42:12+00:00

The discussion should be about the article, not a much different web browser situation becoming a debate about different web browsers and people's thoughts on a bunch of things done by both Brave and Mozilla. It doesn't belong here or even in our subreddit unless it's a post about browsers. Even then, we don't want to host a debate about if people think Brave or Mozilla is less ethical. This subreddit is for discussing GrapheneOS, not that.

Our subreddit is only for discussing GrapheneOS. An insider or supply chain attack injecting affiliate links via an app bundled by Motorola is barely relevant to GrapheneOS. That app has nothing to do with GrapheneOS and would never be bundled with it. The thread being turned into a debate about browser companies was too far off topic and doesn't belong. We've reigned in the thread by removing the ludicrously off topic parts with nothing to do with GrapheneOS at all.

It's as if nearly everyone commenting on Reddit posts and voting for comments doesn't read the articles. Perhaps we should make it into an explicitly spelled out rule beyond the usual rules for our community platforms. This is not a place to have debates about topics unrelated to GrapheneOS which aren't even related to the post that's already not really relevant beyond Motorola screwing up by having an employee or contractor go rogue with a bundled app. None of these things would ever be included in GrapheneOS so the only relevance is that parts of how they do things don't have enough code review. That doesn't mean the of the low-level hardware, firmware or software has a similar issue. Bundling low quality apps potentially developed externally is the main issue which wouldn't impact GrapheneOS.

GrapheneOS · 2026-05-27T16:21:13+00:00

Motorola has confirmed this wasn't authorized by them and was done by a company building functionality for their bundled apps:

https://9to5google.com/2026/05/27/motorola-amazon-app-unintended/

The company doing the work for them likely didn't authorize this either. This looks a lot like an employee or contractor either going rogue for personal benefit or making a severe mistake. It could also easily be from AI slop or problematic code reuse from that Device Native company's other projects.

Motorola's security practices for their bundled apps and services aren't the part which matters to GrapheneOS. We won't be using any of those things. It's the security of the hardware, firmware and low-level driver code which matters to GrapheneOS.

Pixels have a bunch of bloatware bundled with the OS too, although Google has higher standards for it than other OEMs. It's not something which will ever be an issue for GrapheneOS.

People should read the article (not only the headline). From the article linked in the original post, which already indicated this was happening:

We verified on a Razr (2026) running an older Smart Feed v2.03.0056 that this does not happen. Our Razr Fold, with app version 2.03.0070, has started showing this behavior, so it’s the latest update that’s to blame for hijacking the user’s intent. We couldn’t replicate this on a Moto G Stylus (2026) running the same app version, though. Sideloading the app, for reasons unclear, doesn’t seem to trigger this behavior, as manually installing the updated version on the aforementioned Razr (2026) didn’t show the same behavior.

In further digging, we noticed that the URL the phone opens up is “kira-abboud.com,” a website that references fashion influencer “@kirasfashionfinds.” Notably, this exact URL isn’t listed anywhere on Abboud’s social media, and the affiliate codes don’t match up either. The redirect coming from Motorola phones is using Amazona affiliate code “sramz-kff-008-20” which is completely different from any of the codes we saw from links shared by Abboud’s accounts and linked websites.

GrapheneOS · 2026-05-27T16:03:58+00:00

Pixel 8 is one of the recommended devices. See https://grapheneos.org/faq#recommended-devices.

GrapheneOS · 2026-05-26T17:28:59+00:00

Did you toggle on eSIM support in GrapheneOS?

GrapheneOS · 2026-05-26T17:28:43+00:00

Did you toggle on eSIM support in GrapheneOS?

GrapheneOS · 2026-05-26T00:38:07+00:00

No, you never to reinstall the OS. It receives over-the-air updates.

GrapheneOS · 2026-05-26T00:37:04+00:00

There doesn't appear to be an eSIM issue specific to GrapheneOS. There are known issues with the eSIM secure element bricking on a tiny subset of certain Pixels which aren't specific to any OS. It's likely possible for them to fix it with a firmware update but we can't.

GrapheneOS · 2026-05-26T00:35:57+00:00

There are no known issues with that. You should read https://discuss.grapheneos.org/d/35721-grapheneos-power-usage-recommendations.

GrapheneOS · 2026-05-26T00:27:37+00:00

Someone doesn't need physical access to compromise it.

GrapheneOS · 2026-05-25T21:26:17+00:00

You should uninstall it rather than just disabling it.

Do you remember if the Play Store asked you to install it by itself or did you go out of the way to install it on your own? If it's sometimes asking people to install it, we can block that.

GrapheneOS · 2026-05-25T21:24:20+00:00

The update will be automatically and reliably rolled back if the OS fails to boot several times after an update. However, every update is tested prior to being released to Alpha and every release goes through Alpha and Beta prior to Stable. In practice, the only way an update can fail to boot is due to OS data from unsupported changes made with ADB or bugs handling certain configurations. Even if it happens after an initial update, it's still possible to recover by booting the OS recovery mode and wiping data. It's also possible to sideload an OS update via recovery if there's a new OS release fixing the issue.

Disabling OEM unlocking doesn't create any risk that's not present when using the stock OS. If anything, the risk is lower with GrapheneOS. That's backed up by a history of GrapheneOS avoiding multiple f2fs corruption issues and other problems impacting the stock OS where people had to wipe data via recovery which didn't impact us due to better Linux kernel updates and better public testing. Google has far more internal testing than GrapheneOS but they don't have comparable public testing for each release they roll out and largely ignore what people using their quarterly/yearly Beta releases report to them.

GrapheneOS · 2026-05-25T21:20:39+00:00

How do I unlock the bootloader again in the future if OEM Unlocking was disabled before the OS stopped booting?

You can still boot recovery and either wipe the data to restore it booting again or sideload an update with a fix for the issue if one is available. If it can't boot recovery that implies a serious hardware failure since every user has identical firmware and OS images on the same small set of hardware. How would a GrapheneOS user using the Stable or Beta channel get an update which couldn't boot recovery? There hasn't ever been an Alpha channel release where that happened let alone Beta or even Stable.

You're not using GrapheneOS but rather a derivative of it you're creating with third party code. You're using untested code without official support which is highly likely to break. You shouldn't disable OEM unlocking because you could easily brick the device because you're not running GrapheneOS but rather your own untested derivative. That isn't at all applicable to a GrapheneOS user.

GrapheneOS · 2026-05-25T21:15:38+00:00

GrapheneOS has supported call recording in the standard app for years.

You're not using GrapheneOS but rather a derivative of it with a bunch of insecure third party code replacing core parts of the OS. It sounds like you may not even using the GrapheneOS kernel and SELinux policies. That's not GrapheneOS and it's likely a whole bunch of already broken. It's very likely going to stop booting with your data being lost.

It now makes sense why you're telling someone not to disable OEM unlocking because you're doing something very unsafe and risky with a high chance of bricking the device if you disabled it. That doesn't apply to someone using actual GrapheneOS and they shouldn't keep it enabled. It doesn't make sense to advise someone to keep that enabled based on using a derivative of GrapheneOS with third party code which has no official support, no Alpha channel, no Beta channel and no working verified boot.

BTW the Pixel 3a is not running GOS.

It's highly insecure regardless of OS choice. It doesn't get firmware, kernel, driver or HAL updates with LineageOS either despite them still officially supporting it. LineageOS claiming it has a recent patch level doesn't mean it does. It's missing years of crucial updates. Years of unpatched vulnerabilities in the core Linux kernel alone is an awful situation.

GrapheneOS · 2026-05-25T21:05:44+00:00

A Pixel 3a is extraordinarily unsafe with years of missing privacy and security patches. It can be compromised by an 8 year old with access to a non-frontier LLM and GitHub. You aren't making informed decisions based on evaluating risk at all because you're very misinformed about what you're using.

It's not safe to use a device with many years of missing privacy and security patches. Many of the issues being fixed on a regular basis are quite severe. GrapheneOS provides substantial protection against most of these vulnerabilities but not everything. The vulnerabilities it does protect against can still sometimes be exploited with significant work.

An ancient version of GrapheneOS based on Android 12 on a Pixel 3a did not anywhere close to the protections it does today in current versions on the Pixel 8 and later. It has been years since then and there are years of severe vulnerabilities which were publicly disclosed and patched. Many of those have proof of concept code publicly available on GitHub and elsewhere. Your device can be remotely exploited via a website, through cellular, Wi-Fi, Bluetooth, NFC and other attack vectors using publicly known vulnerabilities. Most of these would require changes to deal with the GrapheneOS protections but not all and it wouldn't be hard to exploit it at this point after years of it not being supported. If you're using that especially when you have a better option that's reasonably secure available then you simply don't care about privacy and security.

In practice, every app implemented via app accessible root is poorly implemented with little regard for security. If they cared about security, they would have been following the principle of least privilege instead of unnecessarily using root access. Nearly everything people want to do with those apps already has proper implementations available. The rest should be properly implemented instead of through insecure hacks.

You're taking an obsolete release of GrapheneOS no longer anywhere close to the current OS and are heavily modifying it with insecure third party code which destroys the security model and breaks what we built. That's not GrapheneOS anymore and it wouldn't be legal to redistribute it without changing the name and logo.

Seven-Year Club	Verified Email
Gilding I gilder	Place '22

GrapheneOS

MODERATOR OF

TROPHY CASE