-
-
Notifications
You must be signed in to change notification settings - Fork 30
Expand file tree
/
Copy pathandroid_comparison.htm
More file actions
1228 lines (1070 loc) · 78.1 KB
/
android_comparison.htm
File metadata and controls
1228 lines (1070 loc) · 78.1 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<!DOCTYPE html>
<html lang="en">
<head>
<title>Comparison of Android-based Operating Systems</title>
<meta name="darkreader-lock">
<meta name="description" content="Comparison of Android-based Operating Systems">
<meta name="viewport" content="width=device-width, initial-scale=1">
<meta charset="UTF-8">
<meta name="keywords" content="technology, operating systems, Linux distributions, Android ROMs, desktop environments, web browsers, instant messengers, cloud services, privacy, digital freedom, payments, cryptocurrencies, productivity software">
<meta name="author" content="Alphonse Eylenburg">
<link rel="stylesheet" href="style.css">
<style>
:root {
--legendwidth: 280px;
--distrowidth: 268px;
}
table.comparison {
width: calc(var(--legendwidth) + 6 * var(--distrowidth));
}
table.comparison tr td:nth-child(2) {
border-left: 1px dotted lightgrey;
}
table.appendix {
text-align: center;
table-layout: fixed;
width: 100%;
font-size: small;
}
table.appendix td {
border: 1px solid #ddd;
overflow-wrap: break-word;
width: 25%;
border-color: #444;
}
table.appendix td:first-child {
text-align: left;
}
table.appendix thead {
position: sticky;
position: -webkit-sticky;
top: 0px;
z-index: 10;
font-size: small;
}
.foss {
color: white;
border: 1px solid green;
border-radius: 3px;
background: green;
font-size: x-small;
}
img.logo {
max-width: 150px;
max-height: 75px;
}
@media (prefers-color-scheme: dark) {
#grapheneos-logo {
filter: invert(88%);
}
}
sup {
font-size: x-small;
}
</style>
<body>
<script src="top.js"></script>
<header>
<p><a href="index.html">← Sitemap</a></p>
</header>
<h1>Comparison of Android-based Operating Systems</h1>
<p>This is a comparison of popular Android "ROMs" (better term: AOSP distributions or Android-based OS). Please note I'm not affiliated with any of these projects and I am not giving any specific recommendation. If you think anything is factually incorrect, please let me know.</p>
<p>DivestOS was originally included in this comparison but it was discontinued at the end of 2024. <a href="old/android_comparison_2024old.htm"><strong>For an older version of this comparison which includes DivestOS, please see here.</a></strong></p>
<h2 class="center">Comparison of Android-based Operating Systems</h2>
<p class="center">Source: eylenburg.github.io</p>
<p class="center" style="color: red; font-size: small;">Last updated: 20 March 2026</p>
<p style="font-size: 75%; font-style: italic;"> This table is best viewed on a monitor with 1920px width (Full HD) with 100% display scaling.</p>
<table class="comparison">
<colgroup>
<col style="text-align: left; white-space: nowrap; padding-right: 5px; width: var(--legendwidth);"> <!-- legend -->
<col style="border-left: double; width: var(--distrowidth);">
<col style="border-left: 1px solid lightgrey; width: var(--distrowidth);">
<col style="border-left: 1px solid lightgrey; width: var(--distrowidth);">
<col style="border-left: 1px solid lightgrey; width: var(--distrowidth);">
<col style="border-left: 1px solid lightgrey; width: var(--distrowidth);">
<col style="border-left: 1px solid lightgrey; width: var(--distrowidth);">
<thead>
<tr>
<td class="legend"></td>
<td>GrapheneOS</td>
<td>CalyxOS</td>
<td>IodéOS</td>
<td>/e/</td>
<td>LineageOS</td>
<td>"Stock" Android</td>
</tr>
</thead>
<tbody>
<tr>
<td class="legend"></td>
<td><img class="logo" id="grapheneos-logo" src="pics/logos/android/grapheneos.svg" /></td>
<td style="vertical-align: middle;"><img class="logo" src="pics/logos/android/calyxos.jpg" /></td>
<td style="vertical-align: middle;"><img class="logo" src="pics/logos/android/iodeos.png" /></td>
<td><img class="logo" src="pics/logos/android/eos.png" /></td>
<td style="vertical-align: middle;"><img class="logo" src="pics/logos/android/lineageos.png" /></td>
<td style="vertical-align: middle;"><img class="logo" src="pics/logos/android/android.svg" /></td>
</tr>
<tr>
<td class="legend">Based on</td>
<td>AOSP</td>
<td>AOSP</td>
<td>LineageOS</td>
<td>LineageOS</td>
<td>AOSP</td>
<td>AOSP</td>
</tr>
<tr>
<td class="legend semititle"><br />Freedom</td>
<td></td><td></td><td></td><td></td><td></td><td></td>
</tr>
<tr>
<td class="legend">Free and open source (FOSS)?</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Deblobbed?</td>
<td class="lgreen">Yes, significantly</td>
<td class="lgreen">Yes, significantly</td>
<td class="yellow">Yes, minimal</td>
<td class="yellow">Yes, minimal</td>
<td class="yellow">Yes, minimal</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Can install apps from any source or developer?</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="lgreen tooltip">Play Store, whitelist, 24h wait, <code>adb</code><span class="tooltiptext">From September 2026, apps can only be "sideloaded" (installed from an APK file or alternative app store) if the developer has registered with Google. To register, developers need to pay a fee and reveal their identity to Google. The only workarounds to install apps from outside the Play Store from non-approved developers will be: 1. via <code>adb</code> (when connected to a PC or using Shizuku or AnyAPK), or 2. via an "advanced flow" which requires users to enable sideloading in developer options and wait for 24 hours (only once). These restrictions only apply to "certified" Google devices, i.e. those that have Play Services and Play Protect preinstalled, meaning there are <strong>no restrictions on AOSP</strong>, "custom ROMs", or Chinese phones.</span></td>
</tr>
<tr>
<td class="legend semititle"><br />Major Features</td>
<td></td><td></td><td></td><td></td><td></td><td></td>
</tr>
<tr>
<td class="legend tooltip">Network controls for apps<span class="tooltiptext">The controls on LineageOS-based operating systems are leaky as their approach only disabled direct network access (socket) but doesn't disable indirect access via the INTERNET permission, which provides multiple ways of bypassing them not requiring collusion between apps. This functionality is regularly used by apps with no malicious intent. Collusion between apps is an issue for all kinds of granted access, permissions, etc. and not specific to the INTERNET permission. If INTERNET permission is not blocked though, no collusion is required.</span></td>
<td class="green">Direct and indirect access</td>
<td class="lgreen">Direct access only</td>
<td class="lgreen">Direct access only</td>
<td class="lgreen">Direct access only</td>
<td class="lgreen">Direct access only</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">System-wide connection/tracker blocking</td>
<td class="green">Private DNS setting, or via VPN app</td>
<td class="green">Private DNS setting, or via VPN app</td>
<td class="green">iode-snort app, Private DNS, or VPN</td>
<td class="green">Private DNS setting, or via VPN app</td>
<td class="green">Private DNS setting, or via VPN app</td>
<td class="green">Private DNS setting, or via VPN app</td>
</tr>
<tr>
<td class="legend">Network-based location (without GNSS)</td>
<td class="green tooltip">Opt-in with server choice<span class="tooltiptext">Network-based location is disabled by default (GNSS-based location is used instead), but if it is enabled the user can choose between the Apple location service or a GrapheneOS proxy to it, or alternatively can use the Google Play location service if sandboxed Google Play is installed</span></td>
<td class="green">Yes, using microG location</td>
<td class="green">Yes, using microG location</td>
<td class="green">Yes, using microG location</td>
<td class="red">No</td>
<td class="green">Yes, using Play Services</td>
</tr>
<tr>
<td class="legend">E2E-encrypted phone backups</td>
<td class="green">Yes (Seedvault)</td>
<td class="green">Yes (Seedvault)</td>
<td class="green">Yes (Seedvault)</td>
<td class="green">Yes (Seedvault)</td>
<td class="green">Yes (Seedvault)</td>
<td class="yellow">Yes, but requires Google login</td>
</tr>
<tr>
<td class="legend">Android Auto compatible</td>
<td class="green tooltip">Yes (sandboxed), <a href="https://grapheneos.org/usage#android-auto" target="_blank">see here</a><span class="tooltiptext">GrapheneOS has permission toggles to enable the user to provide the least amount of permissions necessary (e.g. wired Android Auto requires only USB access).</span></td>
<td class="lgreen">Yes (w/ privileged permissions), <a href="https://calyxos.org/docs/guide/android-auto/" target="_blank">see here</a></td>
<td class="lgreen">Yes (w/ privileged permissions), <a href="https://blog.iode.tech/use-android-auto-with-iodeos/" target="_blank">see here</a></td>
<td class="lgreen">Yes (w/ privileged permissions), <a href="https://doc.e.foundation/support-topics/android-auto" target="_blank">see here</a></td>
<td class="red">No</td>
<td class="lgreen">Yes (w/ privileged permissions)</td>
</tr>
<tr>
<td class="legend">Google Pay compatible</td>
<td class="red">No (blocked by Google)</td>
<td class="red">No (blocked by Google)</td>
<td class="red">No (blocked by Google)</td>
<td class="red">No (blocked by Google)</td>
<td class="red">No (blocked by Google)</td>
<td class="lgreen">Yes (w/ privileged permissions)</td>
</tr>
<tr>
<td class="legend tooltip">RCS support in Google Messages<span class="tooltiptext">requires Google Play Services and to work</span></td>
<td class="green">Yes, <a href="https://grapheneos.org/releases#2025092700">see here</a></td>
<td class="red">No (blocked by Google)</td>
<td class="red">No (blocked by Google)</td>
<td class="red">No (blocked by Google)</td>
<td class="red">No (blocked by Google)</td>
<td class="green">Yes</td>
</tr>
<tr>
<td class="legend semititle"><br />Advanced & device-specific features</td>
<td></td><td></td><td></td><td></td><td></td><td></td>
</tr>
<tr>
<td class="legend">Factory reset protection (for stolen devices)</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="yellow tooltip">Yes, but requires Google login<span class="tooltiptext">If the device is stolen and then factory reset, it will not allow setup and use until the original Google account credentials used on the device are entered. To disable FRP before factory reset, one must remove all Google accounts from the device (requiring the passwords). If the device was used without a Google account it will not trigger FRP meaning the device can be reset and reused freely.</span></td>
</tr>
<tr>
<td class="legend">Duress PIN (to wipe device)</td>
<td class="green">Yes, <a href="https://grapheneos.org/features#duress" target="_blank">see here</a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Parental controls</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="green"><span class="tooltip">Yes<span class="tooltiptext">IodeOS has built-in parental controls focused on blocking unwanted data transmission rather than detailed activity monitoring like Family Link. The parental controls in IodeOS allow parents to block categories of content and "recipients," such as "Porn" to censor adult websites and "Social" to block social network apps. It also allowed parents to disable Internet access for specified apps (with password protection).</span></span>, <a href="https://iode.tech/documentation/parental-control/" target="_blank">see here</a></td>
<td class="green">Yes, <a href="https://doc.e.foundation/support-topics/parental-control" target="_blank">see here</a></td>
<td class="red">No</td>
<td class="yellow tooltip">Yes, but requires Google login<span class="tooltiptext">Google Family Link requires a Google account but provides a comprehensive parental control experience, including detailed app usage monitoring and screen time management, the ability to remotely approve or block apps from being downloaded, device location tracking, and content and privacy restrictions enforced through Google Play Services.</span></td>
</tr>
<tr>
<td class="legend">Call recording</td>
<td class="green">Yes</td>
<td class="yellow">Only in selected regions, <a href="https://github.com/CalyxOS/platform_packages_apps_Dialer/blob/android13/java/com/android/dialer/callrecord/res/xml/call_record_states.xml" target="_blank">see here</a></td>
<td class="green">Yes</td>
<td class="yellow">Only in selected regions, <a href="https://gitlab.e.foundation/e/os/android_packages_apps_Dialer/-/blob/a14/java/com/android/dialer/callrecord/res/xml/call_record_states.xml" target="_blank">see here</a></td>
<td class="yellow">Only in selected regions, <a href="https://github.com/LineageOS/android_packages_apps_Dialer/blob/lineage-20.0/java/com/android/dialer/callrecord/res/xml/call_record_states.xml" target="_blank">see here</a></td>
<td class="yellow">Depends on regions and manufacturer</td>
</tr>
<tr>
<td class="legend">Notification forwarding from other user profiles</td>
<td class="green">Yes</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend tooltip">Option to enable screenshots in all apps<span class="tooltiptext">including apps blocking screenshots (<code>FLAG_SECURE</code>)</span></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend tooltip">Hardware-backed attestation API support<span class="tooltiptext">Hardware-backed attestation works through a standard Android hardware attestation API that is available on every device launched with Android 8 or later. This hardware attestation API can be used by apps independently of Google Play Services, meaning apps do not have to rely on the Play Integrity API or other Google Play Services components for device integrity verification. The Play Integrity API itself is based on this hardware attestation API but adds Google's additional layers, including licensing checks. Using the native hardware attestation API allows for verifying security on devices or OSes that do not license Google Mobile Services.</span></td>
<td class="green">Yes, <a href="https://grapheneos.org/articles/attestation-compatibility-guide" target="_blank">see here</a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="green">Yes</td>
</tr>
<tr>
<td class="legend">Charging limit (e.g. 80%) on supported devices</span></td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
</tr>
<tr>
<td class="legend tooltip">(Pixel only:) Force VoLTE, VoNR, 5G, VoWiFi<span class="tooltiptext">Previously, users of Pixel phones could change or set carrier network features like VoLTE (Voice over LTE), VoNR (Voice over New Radio, i.e. 5G voice), and WiFi Calling (VoWiFi), which is useful for users of imported Pixel phones in regions where these features are not supported. This carrier settings override was possible using <code>adb</code> shell commands or apps like Pixel IMS. With the December 2025 Android Security Bulletin patches (published in October 2025), Google removed support for these carrier override settings via <code>adb</code>, although <a href="https://www.androidauthority.com/pixel-ims-update-fix-3606811/" target="_blank">as of 14 October 2025, the developer behind the Pixel IMS app has implemented a workaround</a>.<br /><br />Note that this was only possible on Pixel phones as they uniquely allowed this override because Google's implementation of the Android telephony framework granted higher-than-usual privileges to <code>adb</code> on Pixel devices. This was originally intended as a test and debugging mechanism for developers and engineers, making it possible to override carrier-related telephony settings through ADB commands. Google's decision to open this up for Pixels (until Q4 2024) was a quirk and it was never part of general Android policy or documentation for end users.</span></td>
<td class="green tooltip">Yes (for Google Pixel)<span class="tooltiptext">In "Carrier settings overrides" in the Settings app.</span></td>
<td class="yellow tooltip">via Pixel IMS app<span class="tooltiptext">Removed in AOSP code with a security update in October 2025 (which has NOT yet been implemented by CalyxOS); although <a href="https://www.androidauthority.com/pixel-ims-update-fix-3606811/" target="_blank">as of 14 October 2025, the developer behind the Pixel IMS app has implemented a workaround</a>, though it can also be patched by Google in the future.</td>
<td class="yellow tooltip">via Pixel IMS app<span class="tooltiptext">Removed in AOSP code with a security update in October 2025 (which has NOT yet been implemented by IodeOS); although <a href="https://www.androidauthority.com/pixel-ims-update-fix-3606811/" target="_blank">as of 14 October 2025, the developer behind the Pixel IMS app has implemented a workaround</a>, though it can also be patched by Google in the future.</td>
<td class="yellow tooltip">via Pixel IMS app<span class="tooltiptext">Removed in AOSP code with a security update in October 2025 (which has NOT yet been implemented by /e/); although <a href="https://www.androidauthority.com/pixel-ims-update-fix-3606811/" target="_blank">as of 14 October 2025, the developer behind the Pixel IMS app has implemented a workaround</a>, though it can also be patched by Google in the future.</td>
<td class="yellow tooltip">via Pixel IMS app<span class="tooltiptext">Removed in AOSP code with a security update in October 2025 (which has NOT yet been implemented by LineageOS); although <a href="https://www.androidauthority.com/pixel-ims-update-fix-3606811/" target="_blank">as of 14 October 2025, the developer behind the Pixel IMS app has implemented a workaround</a>, though it can also be patched by Google in the future.</td>
<td class="yellow tooltip">via Pixel IMS app<span class="tooltiptext">Removed in AOSP code with a security update in October 2025; although <a href="https://www.androidauthority.com/pixel-ims-update-fix-3606811/" target="_blank">as of 14 October 2025, the developer behind the Pixel IMS app has implemented a workaround</a>, though it can also be patched by Google in the future.</td>
</tr>
<tr>
<td class="legend semititle tooltip"><br />Degoogling (connections to Google)
<span style="font-size: 50%; color: blue;">COLOURS</span><span class="tooltiptext">LOGIC FOR COLOUR SCHEME:
<br /><br />
RED<br />
- connects to Google, no opt-out
<br /><br />
LIGHT RED<br />
- connects to Google by default but function can be turned off (no option of using another provider)
<br /><br />
YELLOW<br />
- function is off by default but can connect to Google if needed (no option of using another provider)
<br /><br />
LIGHT GREEN<br />
- connects to Google by default but can be changed to another provider
<br /><br />
GREEN<br />
- does not connect to Google by default but instead connects to the developer of the operating system (no third party needs to be trusted)<br />
- multiple providers offered and user can decide<br />
- no data shared with any provider
<br /><br />
BLUE<br />
- does not connect to Google by default but instead connects to another (non-Google) third party provider
<br /><br />
WHITE<br />
- function is not supported</span></td>
<td></td><td></td><td></td><td></td><td></td><td></td>
</tr>
<tr>
<td class="legend">eSIM activation</td>
<td class="green tooltip">Google eUICC w/o data sharing<span class="tooltiptext">Disabled by default. Unlike the regular Google eUICC management app, it doesn't require Google Play and cannot share data with it. It doesn't communicate with Google servers unless the carrier is hosting with them, which would involve using their servers regardless.</span></td>
<td class="red">Google eUICC (preinstalled)</td>
<td class="green">OpenEUICC (on most devices)</td>
<td class="red">Google eUICC (preinstalled)</td>
<td class="red">Google eUICC (preinstalled)</td>
<td class="red">Google eUICC (preinstalled)</td>
</tr>
<tr>
<td class="legend">Provider for network-based location</td>
<td class="green tooltip">None <sup>default</sup>, GrapheneOS, Apple, or Google<span class="tooltiptext">Network-based location is disabled by default (GNSS-based location is used instead), but if it is enabled the user can choose between the Apple location service or a GrapheneOS proxy to it, or alternatively can use the Google Play location service if sandboxed Google Play is installed</span></td>
<td class="green">microG location</td>
<td class="green">microG location</td>
<td class="green">microG location</td>
<td>n/a</td>
<td class="red">Google</td>
</tr>
<tr>
<td class="legend">SUPL (for Assisted GNSS)</td>
<td class="green">GrapheneOS <sup>default</sup>, Google or none</td>
<td class="lred">Google <sup>default</sup>, or none</td>
<td class="lred">Google <sup>default</sup>, or none</td>
<td class="yellow">None <sup>default</sup>, or Google</td>
<td class="lred">Google <sup>default</sup>, or none</td>
<td class="red">Google</td>
</tr>
<tr>
<td class="legend tooltip">PSDS/XTRA <span style="font-size: 75%;">("Standard" depends on GPS chipset)</span><span class="tooltiptext">The standard server used depends on the GPS chipset, which is usually Qualcomm, Broadcom, or Samsung, or in the case of Tensor chips (Google Pixel 6 and later) they connect to a Google server. Some ROMs override these settings.<br /><a href="https://web.archive.org/web/20250111112822/https://divestos.org/misc/gnss.txt" target="_blank" style="color: white;">Click here for details and which device information are sent.</a></span></td>
<td class="green">GrapheneOS <sup>default</sup>, <span class="tooltip">Standard<span class="tooltiptext">Google / Broadcom / Qualcomm / Samsung depending on the device. At the moment, only Google Pixels are supported by GrapheneOS, for which the standard connection is Google (since the Pixel 6)</span></span>, or none</td>
<td class="blue"><span class="tooltip">Standard (excl. Google)<span class="tooltiptext">Broadcom / Qualcomm / Samsung depending on the device, for Google Pixel 6 and later (Tensor chip) the standard connection to Google is replaced with a connection to Broadcom instead <a href="https://www.kuketz-blog.de/calyxos-de-googled-geht-anders-custom-roms-teil2/" target="_blank">(source)</a></span></span> <sup>default</sup>, or none</td>
<td class="blue"><span class="tooltip">Standard (excl. Google)<span class="tooltiptext">Broadcom / Qualcomm / Samsung depending on the device, for Google Pixel 6 and later (Tensor chip) the standard connection to Google is replaced with a connection to Broadcom instead <a href="https://www.kuketz-blog.de/iodeos-datenschutzfreundlich-aber-abstriche-bei-der-sicherheit-custom-roms-teil3/" target="_blank">(source)</a></span></span> <sup>default</sup>, or none</td>
<td class="yellow">None <sup>default</sup>, or <span class="tooltip">Standard<span class="tooltiptext">Google / Broadcom / Qualcomm / Samsung depending on the device</span></span></td>
<td class="lred"><span class="tooltip">Standard<span class="tooltiptext">Google / Broadcom / Qualcomm / Samsung depending on the device</span></span> <sup>default</sup>, or none</td>
<td class="red"><span class="tooltip">Standard<span class="tooltiptext">Google / Broadcom / Qualcomm / Samsung depending on the device</span></span></td>
</tr>
<!--
<tr>
<td class="legend tooltip">PSDS - Google Pixel 6 and later (Tensor SoC)<span class="tooltiptext">The default server used depends on the GPS chipset, e.g. phones with Qualcomm chips (e.g. Snapdragon) connect to a Qualcomm server, while newer Google Pixels with Tensor chips connect to a Google server, and other phones with Broadcom GPS (e.g. Exynos) connect to a Broadcom server. Some ROMs override these settings. <br /><a href="https://web.archive.org/web/20250111112822/https://divestos.org/misc/gnss.txt" target="_blank" style="color: white;">Click here for details and which device information are sent.</a></span></td>
<td class="green">GrapheneOS <sup>default</sup>, Google, or none</td>
<td class="blue">Broadcom <sup>default</sup>, or none</td>
<td class="blue">Broadcom <sup>default</sup>, or none</td>
<td class="yellow">None <sup>default</sup>, or Google</td>
<td class="lred">Google <sup>default</sup>, or none</td>
<td class="red">Google</td>
</tr>
<tr>
<td class="legend tooltip">PSDS - other phones (no Tensor SoC)<span class="tooltiptext">The default server used depends on the GPS chipset, e.g. phones with Qualcomm chips (e.g. Snapdragon) connect to a Qualcomm server, while newer Google Pixels with Tensor chips connect to a Google server, and other phones with Broadcom GPS (e.g. Exynos) connect to a Broadcom server. Some ROMs override these settings. <br /><a href="https://web.archive.org/web/20250111112822/https://divestos.org/misc/gnss.txt" target="_blank" style="color: white;">Click here for details and which device information are sent.</a></span></td>
<td class="green">GrapheneOS <sup>default</sup>, Standard (Qualcomm/Broadcom/Samsung), or none</td>
<td class="blue">Standard (Qualcomm/Broadcom/Samsung) <sup>default</sup>, or none</td>
<td class="blue">Standard (Qualcomm/Broadcom/Samsung) <sup>default</sup>, or none</td>
<td class="yellow">None <sup>default</sup>, or Standard (Qualcomm/Broadcom/Samsung)</td>
<td class="blue">Standard (Qualcomm/Broadcom/Samsung) <sup>default</sup>, or none</td>
<td class="blue">Standard (Qualcomm/Broadcom/Samsung)</td>
</tr>
-->
<tr>
<td class="legend">Connectivity check/captive portal</td>
<td class="green">GrapheneOS <sup>default</sup>, Google, or none</td>
<td class="lgreen"><span class="tooltip">Google (can be changed)<span class="tooltiptext">can be changed with `adb` command</span></span></td>
<td class="blue"><span class="tooltip">Kuketz.de (can be changed)<span class="tooltiptext">can be changed with `adb` command</span></span></td>
<td class="green"><span class="tooltip">Murena.io (related to /e/) (can be changed)<span class="tooltiptext">can be changed with `adb` command</span></span></td>
<td class="lgreen"><span class="tooltip">Google (can be changed)<span class="tooltiptext">can be changed with `adb` command</span></span></td>
<td class="lgreen"><span class="tooltip">Google (can be changed)<span class="tooltiptext">can be changed with `adb` command</span></span></td>
</tr>
<tr>
<td class="legend">DNS connectivity check</td>
<td class="green">GrapheneOS <sup>default</sup>, or Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
</tr>
<tr>
<td class="legend">DNS server fallback</td>
<td class="blue">Cloudflare</td>
<td class="blue">Cloudflare</td>
<td class="blue">Quad9</td>
<td class="blue">Quad9</td>
<td class="red">Google</td>
<td class="red">Google</td>
</tr>
<tr>
<td class="legend">Network time</td>
<td class="green">GrapheneOS <sup>default</sup>, or none</td>
<td class="lgreen"><span class="tooltip">Google (can be changed)<span class="tooltiptext">can be changed with `adb` command</span></span> & carrier</td>
<td class="blue"><span class="tooltip">NTP.org (can be changed)<span class="tooltiptext">Server pool with arbitrary providers, which can include Google-hosted servers or even malicious servers. NTP server can be changed with `adb` command.</span></span> & carrier</td>
<td class="blue"><span class="tooltip">NTP.org (can be changed)<span class="tooltiptext">Server pool with arbitrary providers, which can include Google-hosted servers or even malicious servers. NTP server can be changed with `adb` command.</span></span> & carrier</td>
<td class="lgreen"><span class="tooltip">Google (can be changed)<span class="tooltiptext">can be changed with `adb` command</span></span> & carrier</td>
<td class="lgreen"><span class="tooltip">Google (can be changed)<span class="tooltiptext">can be changed with `adb` command</span></span> & carrier</td>
</tr>
<tr>
<td class="legend">Hardware attestation provisioning</td>
<td class="green">GrapheneOS <sup>default</sup>, or Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
</tr>
<tr>
<td class="legend">DRM (Widevine) provisioning</td>
<td class="green">GrapheneOS <sup>default</sup>, or Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
</tr>
<tr>
<td class="legend semititle"><br />Google Play Services</td>
<td></td><td></td><td></td><td></td><td></td><td></td>
</tr>
<tr>
<td class="legend">Implementation</td>
<td class="tooltip">GmsCompat (sandboxed Google Play)<span class="tooltiptext">GrapheneOS does not include Google Play as a preinstalled app, but it includes an open source compatibility layer for users who choose to use it. Users can alternatively install microG on GrapheneOS, albeit GrapheneOS does not support signature spoofing. Not all microG functionality requires signature spoofing, for example FCM works with microG without signatures spoofing to the extent it works without special privileges (e.g. microG needs to use a privileged API to wake apps and keep them awake for a short period of time to handle FCM messages).</span></td>
<td>microG</td>
<td>microG</td>
<td>microG</td>
<td rowspan="7">None by default. <br />It's possible to install microG manually (LineageOS <a href="https://review.lineageos.org/c/LineageOS/android_frameworks_base/+/383574" target="_blank">supports signature spoofing for microG</a> since 2024). Alternatively, there are <a href="https://lineage.microg.org/" target="_blank">ROMs with microG preinstalled</a> or one can <a href="https://wiki.lineageos.org/gapps" target="_blank">add Google apps</a> during the installation process, but this is not officially supported by LineageOS. <!--Alternatively, there is the <a href="https://lineage.microg.org/" target="_blank">LineageOS for microG</a> project that integrates microG in LineageOS.</td>-->
<td>Google Play Services</td>
</tr>
<tr>
<td class="legend">Optional?</td>
<td class="green">Yes (not preinstalled)</td>
<td class="green">Yes (preinstalled but opt-out)</td>
<td class="green">Yes (preinstalled but opt-out)</td>
<td class="yellow">Can be disabled via developer mode</td>
<!-- skipped -->
<td class="red">No (preinstalled without opt-out)</td>
</tr>
<tr>
<td class="legend">Runs in standard app sandbox?</td>
<td class="green">Yes</td>
<td class="red tooltip">No<span class="tooltiptext">Runs in the `priv_app` SELinux domain instead of `untrusted_app`, which gives it access to internal system APIs and data along with it being much less isolated.</span></td>
<td class="red tooltip">No<span class="tooltiptext">Runs in the `priv_app` SELinux domain instead of `untrusted_app`, which gives it access to internal system APIs and data along with it being much less isolated.</span></td>
<td class="red tooltip">No<span class="tooltiptext">Runs in the `priv_app` SELinux domain instead of `untrusted_app`, which gives it access to internal system APIs and data along with it being much less isolated.</span></td>
<!-- skipped -->
<td class="red tooltip">No<span class="tooltiptext">Runs in the `priv_app` SELinux domain instead of `untrusted_app`, which gives it access to internal system APIs and data along with it being much less isolated.</span></td>
</tr>
<tr>
<td class="legend">Can be limited to user or work profile?</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td>? (TBC)</td>
<td>? (TBC)</td>
<!-- skipped -->
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Signature spoofing needed/allowed?</td>
<td class="green">No</td>
<td class="lgreen">Only for Google signature</td>
<td class="lgreen">Only for Google signature</td>
<td class="lgreen">Only for Google signature</td>
<!-- skipped -->
<td class="green">No</td>
</tr>
<tr>
<td class="legend">Push notifications via Google FCM?</td>
<td class="green">Yes</td>
<td class="green">Optional</td>
<td class="green">Optional</td>
<td class="green">Optional</td>
<!-- skipped -->
<td class="green">Yes</td>
</tr>
<tr>
<td class="legend tooltip">Google Play Integrity?<span class="tooltiptext">From Android 13 onwards, MEETS_BASIC_INTEGRITY can only be met if the app was installed through the Play Store, which is only possible when logged in to a Google account. However, even if you later log out from your Google account, or if you install the app from elsewhere but spoof it as installed from Google Play, some apps may still refuse to run as they run additional checks that the user is currently logged in to their Google account.</span></td>
<td class="lgreen tooltip">Passes Basic Integrity only, <a href="https://grapheneos.org/usage#banking-apps" target="_blank">see here</a><span class="tooltiptext">Passes MEETS_BASIC_INTEGRITY but not MEETS_DEVICE_INTEGRITY or MEETS_STRONG_INTEGRITY which require a certification from Google.</td>
<td class="lgreen tooltip">Passes Basic Integrity only<span class="tooltiptext">microG v0.3.6.244735, which is part of CalyxOS since 2024-12-31, passes MEETS_BASIC_INTEGRITY but not MEETS_DEVICE_INTEGRITY or MEETS_STRONG_INTEGRITY which require a certification from Google.</td>
<td class="lgreen tooltip">Passes Basic Integrity only<span class="tooltiptext">microG v0.3.6.244735 and above pass MEETS_BASIC_INTEGRITY but not MEETS_DEVICE_INTEGRITY or MEETS_STRONG_INTEGRITY which require a certification from Google.</td>
<td class="lgreen tooltip">Passes Basic Integrity only<span class="tooltiptext">microG v0.3.6.244735 and above pass MEETS_BASIC_INTEGRITY but not MEETS_DEVICE_INTEGRITY or MEETS_STRONG_INTEGRITY which require a certification from Google.</td>
<!-- skipped -->
<td class="green">Yes</td>
</tr>
<tr>
<td class="legend tooltip">Disables Play Integrity install checks?<span class="tooltiptext">These checks, undertaken by Play Store, involve validating the app's developer credentials, authenticity, and confirming the app is a genuine Play Store version via cryptographic signatures or developer verification services provided by Google. These checks are about confirming the app is genuine and unmodified, but they are fundamentally anti-competitive as they enforce the use of Play Store linked to a Google account to download apps. While these checks purport to ensure app authenticity and security, they are fundamentally anti-competitive since they restrict users to obtaining apps only from the Play Store and require Google services licensing, thereby locking out alternative app sources or operating systems. Many apps use the Play Integrity API to block apps installed from alternative sources such as APK sideloads or Aurora Store, which harms user choice and fair competition. Disabling these checks can be useful for use apps that were "sideloaded", e.g. installed from Aurora Store or APK.</span></td>
<td class="green tooltip">Yes (if signature matches)<span class="tooltiptext">GrapheneOS disables or bypasses certain restrictive Play Store install checks after cryptographically verifying the Play Store source stamp signature of the app. This allows apps to run even if installed from alternative sources like Aurora Store or APKs. However, some apps may perform their own installation source (<code>PackageManager.getInstallerPackageName</code>) checks independently, which is why spoofing the install source might still be necessary to pass those app-specific checks.</span></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend tooltip">Option to mark apps as installed by Play Store?<span class="tooltiptext">In addition to the the checks undertaken by Play Integrity (see above), apps can check if they were installed by querying the system's installer package name (e.g. <code>com.android.vending</code> for Play Store). Some apps block or restrict functionality if installed from outside the Play Store based on this check.</span></td>
<td class="yellow tooltip">No, only via <code>adb</code><span class="tooltiptext">GrapheneOS is not spoofing the installation source at the moment but there are plans to eventually add such a feature.<br /><code>adb</code> can spoof the installation source, using a command like <code>adb shell pm install -i com.android.vending -r /path/to/app.apk</code>. Shizuku is an Android app that allows users to do it using wireless debugging and without an external device (PC).</span></td>
<td class="lgreen tooltip">Done if installed from Aurora Store<span class="tooltiptext">Apps installed from Aurora Store are automatically marked as installed from Play Store, without further signature checks</span></td>
<td class="lgreen tooltip">Done if installed from Aurora Store<span class="tooltiptext">Apps installed from Aurora Store are automatically marked as installed from Play Store, without further signature checks</span></td>
<td class="yellow tooltip">No, only via <code>adb</code><span class="tooltiptext"><br /><code>adb</code> can spoof the installation source, using a command like <code>adb shell pm install -i com.android.vending -r /path/to/app.apk</code>. Shizuku is an Android app that allows users to do it using wireless debugging and without an external device (PC).</span></td>
<td class="yellow tooltip">No, only via <code>adb</code><span class="tooltiptext"><br /><code>adb</code> can spoof the installation source, using a command like <code>adb shell pm install -i com.android.vending -r /path/to/app.apk</code>. Shizuku is an Android app that allows users to do it using wireless debugging and without an external device (PC).</span></td>
<td class="yellow tooltip">No, only via <code>adb</code><span class="tooltiptext"><br /><code>adb</code> can spoof the installation source, using a command like <code>adb shell pm install -i com.android.vending -r /path/to/app.apk</code>. Shizuku is an Android app that allows users to do it using wireless debugging and without an external device (PC).</span></td>
</tr>
<tr>
<td class="legend semititle"><br />Privacy</td>
<td></td><td></td><td></td><td></td><td></td><td></td>
</tr>
<tr>
<td class="legend">Storage scopes</td>
<td class="green">Yes, <a href="https://grapheneos.org/features#storage-scopes" target="_blank">see here</a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Contact scopes</td>
<td class="green">Yes, <a href="https://grapheneos.org/features#contact-scopes" target="_blank">see here</a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Per-app sensor controls</td>
<td class="green">Yes, <a href="https://grapheneos.org/features#sensors-permission-toggle" target="_blank">see here </a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Per-connection DHCP state flushing</td>
<td class="green">Yes</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">MAC address randomization</td>
<td class="green">Per connection, <a href="https://grapheneos.org/features#wifi-privacy" target="_blank">see here</a></td>
<td class="lgreen">Per network</td>
<td class="lgreen">Per network</td>
<td class="lgreen">Per network</td>
<td class="lgreen">Per network</td>
<td class="lgreen">Per network</td>
</tr>
<tr>
<td class="legend">SUPL: IMSI or phone number sent?</td>
<td class="green">No</td>
<td class="green">No</td>
<td class="green">No</td>
<td class="green">No</td>
<td class="green">No</td>
<td class="red">Yes</td>
</tr>
<tr>
<td class="legend tooltip">Qualcomm XTRA: user agent sent?<span class="tooltiptext">Only relevant for phones with Qualcomm GPS chips. Doesn't apply to Broadcom or Samsung. May include chipset serial number, device manufacturer and model, carrier, and Android version. <a href="https://web.archive.org/web/20250111112822/https://divestos.org/misc/gnss.txt" target="_blank" style="color: white;">Click here for details and which device information are sent.</a></span></td>
<td class="green">No</td>
<td class="yellow tooltip">Partially (for Qualcomm chips)<span class="tooltiptext">Chipset serial number is stripped out but other less unique device information remain</span></td>
<td class="yellow tooltip">Partially (for Qualcomm chips)<span class="tooltiptext">Chipset serial number is stripped out but other less unique device information remain</span></td>
<td class="yellow tooltip">Partially (for Qualcomm chips)<span class="tooltiptext">Chipset serial number is stripped out but other less unique device information remain</span></td>
<td class="yellow tooltip">Partially (for Qualcomm chips)<span class="tooltiptext">Chipset serial number is stripped out but other less unique device information remain</span></td>
<td class="lred">for Qualcomm GPS chips</td>
</tr>
<tr>
<td class="legend">Closed cross-profile package leaks?</td>
<td class="green">Yes</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Closed device identifier leaks?</td>
<td class="green">Yes, <a href="https://grapheneos.org/features#closed-device-identifier-leaks" target="_blank">see here</a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend tooltip">Closed VPN leaks?<span class="tooltiptext">when "block connections without VPN" is enabled</span></td>
<td class="yellow tooltip">Partially, <a href="https://grapheneos.org/features#improved-vpn-leak-blocking">see here</a><span class="tooltiptext">Some leaks tied to the Private DNS feature still remain and "finding and resolving all forms of VPN leaks is one of [GrapheneOS's] top priorities at the moment". Some other connections, e.g. WiFi calling (VoWiFi) or WiFi connectivity checks (captive portal) are deliberately allowed by Android to circumvent the VPN and this is not changed in GrapheneOS.</span></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Metadata stripping for screenshots</td>
<td class="green">Yes, <a href="https://grapheneos.org/features#private-screenshots" target="_blank">see here </a></td>
<td class="green">Yes, <a href="https://calyxos.org/news/2023/10/04/october-security-update/" target="_blank">see here </a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">EXIF metadata stripping for photos</td>
<td class="green">Yes, <a href="https://grapheneos.org/usage#grapheneos-camera-app" target="_blank">see here </a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="yellow">Available as option</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Location tagging for photos</td>
<td class="green">Opt-in</td>
<td class="green">Opt-in, <a href=https://calyxos.org/docs/guide/security/location/#exif-metadata" target="_blank">see here for more info</a></td>
<td class="green">Opt-in</td>
<td class="green">Opt-in</td>
<td class="green">Opt-in</td>
<td class="lgreen">Opt-out</td>
</tr>
<tr>
<td class="legend">Tracking through Android Advertising ID?</td>
<td class="green tooltip">Not part of the system<span class="tooltiptext">if Play Services are installed by the user, the Advertising ID can be deleted in settings</span></td>
<td class="green tooltip">Randomized ID<span class="tooltiptext">microG will generate a random advertising ID for each request</span></td>
<td class="green tooltip">Randomized ID<span class="tooltiptext">microG will generate a random advertising ID for each request</span></td><td class="green tooltip">Randomized ID<span class="tooltiptext">microG will generate a random advertising ID for each request</span></td>
<td class="green tooltip">Not part of the system<span class="tooltiptext">if microG is installed by the user, it will generate a random Advertising ID for each request; if Play Services are installed by the user, the Advertising ID can be deleted in settings</span></td>
<td class="lgreen">Yes, but can be deleted in settings</td>
</tr>
<tr>
<td class="legend semititle"><br />Security</td>
<td></td><td></td><td></td><td></td><td></td><td></td>
</tr>
<tr>
<td class="legend">Verified boot (if supported by device)?</td>
<td class="green">Yes, incl. system app updates</td>
<td class="yellow">Yes, but excl. system app updates</td>
<td class="yellow">Yes, but excl. system app updates</td>
<td class="lred">w/ test keys; excl. system app updates</td>
<td class="red">No</td>
<td class="yellow">Yes, but excl. system app updates</td>
</tr>
<tr>
<td class="legend">Hardware-based security verification</td>
<td class="green">Yes, <a href="https://grapheneos.org/features#auditor" target="_blank"> see here</a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="green">Yes, mandatory since Android 8</a></td>
</tr>
<tr>
<td class="legend">System app downgrade protection</td>
<td class="green">For updates and boot, with fs-verity</td>
<td class="red">For updates (incomplete)</td>
<td class="red">For updates (incomplete)</td>
<td class="red">For updates (incomplete)</td>
<td class="red">For updates (incomplete)</td>
<td class="red">For updates (incomplete)</td>
</tr>
<tr>
<td class="legend">Secure application spawning?</td>
<td class="green">Yes (exec)</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Hardware memory tagging?</td>
<td class="green">Yes, if supported by device</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="lred tooltip">Advanced Protection, very limited scope<span class="tooltiptext">If Advanced Protection mode is enabled, it enables hardware memory tagging (when supported by the hardware) but only for apps that are explicitly opting in to it and not for the kernel or most of the base OS.</span></td>
</tr>
<tr>
<td class="legend">Android Runtime <span class="tooltip">JIT<span class="tooltiptext">Just-In-Time</span></span> compilation/profiling</td>
<td class="green"><span class="tooltip">AOT<span class="tooltiptext">Ahead-Of-Time</span></span> compilation w/o profiling</td>
<td class="red">Interpreter/<span class="tooltip">JIT<span class="tooltiptext">Just-In-Time</span></span> with profiling</td>
<td class="red">Interpreter/<span class="tooltip">JIT<span class="tooltiptext">Just-In-Time</span></span> with profiling</td>
<td class="red">Interpreter/<span class="tooltip">JIT<span class="tooltiptext">Just-In-Time</span></span> with profiling</td>
<td class="red">Interpreter/<span class="tooltip">JIT<span class="tooltiptext">Just-In-Time</span></span> with profiling</td>
<td class="red">Interpreter/<span class="tooltip">JIT<span class="tooltiptext">Just-In-Time</span></span> with profiling</td>
</tr>
<tr>
<td class="legend tooltip">Dynamic code loading prevention for apps<span class="tooltiptext"><a href="https://github.com/eylenburg/eylenburg.github.io/issues/85" target="_blank" style="color: white;">see here for details</a></span></td>
<td class="green">System, opt-in for non-system apps</td>
<td class="red">None</td>
<td class="red">None</td>
<td class="red">None</td>
<td class="red">None</td>
<td class="red">None</td>
</tr>
<tr>
<td class="legend">Secure TLS for SUPL?</td>
<td class="green tooltip">TLSv1.3 or TLSv1.2<span class="tooltiptext">GrapheneOS still uses TLSv1.2-only for SUPL on Broadcom GNSS devices but moved to TLSv1.3-only for SUPL on Samsung GNSS devices.</span></td>
<td class="yellow tooltip">TLSv1.3/1.2/1.1/1.0 depending on device<span class="tooltiptext">Some older end-of-life devices only support TLSv1.1 or TLSv1.0</span></td>
<td class="yellow tooltip">TLSv1.3/1.2/1.1/1.0 depending on device<span class="tooltiptext">Some older end-of-life devices only support TLSv1.1 or TLSv1.0</span></td>
<td class="yellow tooltip">TLSv1.3/1.2/1.1/1.0 depending on device<span class="tooltiptext">Some older end-of-life devices only support TLSv1.1 or TLSv1.0</span></td>
<td class="yellow tooltip">TLSv1.3/1.2/1.1/1.0 depending on device<span class="tooltiptext">Some older end-of-life devices only support TLSv1.1 or TLSv1.0</span></td>
<td class="yellow tooltip">TLSv1.3/1.2/1.1/1.0 depending on device<span class="tooltiptext">Some older end-of-life devices only support TLSv1.1 or TLSv1.0</span></td>
</tr>
<tr>
<td class="legend">Fallback DNS server with DNSSEC?</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
</tr>
<tr>
<td class="legend">Secure connection to network time server?</td>
<td class="green">HTTPS via GrapheneOS server</td>
<td class="red">NTP w/o NTS and <span class="tooltip">carrier-based time<span class="tooltiptext">insecure because cellular networks lack proper authentication</span></span></td>
<td class="red">NTP w/o NTS and <span class="tooltip">carrier-based time<span class="tooltiptext">insecure because cellular networks lack proper authentication</span></span></td>
<td class="red">NTP w/o NTS and <span class="tooltip">carrier-based time<span class="tooltiptext">insecure because cellular networks lack proper authentication</span></span></td>
<td class="red">NTP w/o NTS and <span class="tooltip">carrier-based time<span class="tooltiptext">insecure because cellular networks lack proper authentication</span></span></td>
<td class="red">NTP w/o NTS and <span class="tooltip">carrier-based time<span class="tooltiptext">insecure because cellular networks lack proper authentication</span></span></td>
</tr>
<tr>
<td class="legend tooltip">Can disable USB-C and pogo pins data?<span class="tooltiptext">See here for details: <a href="https://github.com/eylenburg/eylenburg.github.io/issues/60" target="_blank" style="color: white;">[1]</a>, <a href="https://github.com/eylenburg/eylenburg.github.io/issues/28" target="_blank" style="color: white;">[2]</a>, <a href="https://github.com/eylenburg/eylenburg.github.io/issues/54" target="_blank" style="color: white;">[3]</a></span></td>
<td class="green">Default (while locked), <a href="https://grapheneos.org/features#usb-c-port-and-pogo-pins-control" target="_blank">see here</a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend tooltip">Can disable USB-C charging?<span class="tooltiptext">See here for details: <a href="https://github.com/eylenburg/eylenburg.github.io/issues/60" target="_blank" style="color: white;">[1]</a>, <a href="https://github.com/eylenburg/eylenburg.github.io/issues/28" target="_blank" style="color: white;">[2]</a>, <a href="https://github.com/eylenburg/eylenburg.github.io/issues/54" target="_blank" style="color: white;">[3]</a></span></td>
<td class="green">Opt-in (after boot), <a href="https://grapheneos.org/features#usb-c-port-and-pogo-pins-control" target="_blank">see here</a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend tooltip">Can disable USB connections?<span class="tooltiptext">See here for details: <a href="https://github.com/eylenburg/eylenburg.github.io/issues/60" target="_blank" style="color: white;">[1]</a>, <a href="https://github.com/eylenburg/eylenburg.github.io/issues/28" target="_blank" style="color: white;">[2]</a>, <a href="https://github.com/eylenburg/eylenburg.github.io/issues/54" target="_blank" style="color: white;">[3]</a></span></td>
<td class="green tooltip">Default (while locked), <a href="https://grapheneos.org/features#usb-c-port-and-pogo-pins-control" target="_blank">see here</a><span class="tooltiptext">Hardware and software</span></td>
<td class="lgreen tooltip">Default (while locked), software only<span class="tooltiptext">Incomplete implementation. Can only disable high level software attack surface. Lacks a way to block new USB connections without ending existing connections. The mode for disabling USB connections while locked continues allowing new connections until existing connections end, including a connection through another method such as a pogo pins USB connection to a stand.</span></td>
<td class="lred"><em>? (TBC - like Lineage or stock?)</em></td>
<td class="lred"><em>? (TBC - like Lineage or stock?)</em></td>
<td class="yellow tooltip">Opt-in, software only<span class="tooltiptext">Incomplete implementation. Can only disable high level software attack surface. Cannot disable USB until after early boot. Lacks a way to block new USB connections without ending existing connections. The mode for disabling USB connections while locked continues allowing new connections until existing connections end, including a connection through another method such as a pogo pins USB connection to a stand.</span></td>
<td class="yellow"><span class="tooltip">Advanced Protection<span class="tooltiptext">When Advanced Protection Mode is enabled, it blocks new USB connections at a software level after the device is locked</span></span> or <span class="tooltip">Device admin API<span class="tooltiptext">Requires installing a device admin app like Sentry. Can only disable high level software attack surface. Cannot disable USB until after early boot. Lacks a way to block new USB connections without ending existing connections.</span></span></td>
</tr>
<tr>
<td class="legend">Can auto-disable WiFi if unused?</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Can auto-disable Bluetooth if unused?</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Can auto-disable NFC if unused?</td>
<td class="red tooltip">No<span class="tooltiptext"><a href="https://grapheneos.org/releases#2025070800" target="_blank">This featured was removed in July 2025 due to bugs</a></span></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Auto-reboot timer for locked devices</td>
<td class="green">Yes</td>
<td class="lred tooltip">Yes, but no BFU (before first unlock) state<span class="tooltiptext">CalyxOS has a disabled-by-default port of an older GrapheneOS implementation of the auto-reboot feature, which was determined to not be as robust due to being able to bypass it by crashing <code>system_server</code>. It also lacks the memory clearing required to get the device properly back at rest for reboots. Therefore it can't return the device to a proper BFU (before first unlock) state like the GrapheneOS and iOS implementations.</span></td>
<td class="lred tooltip">Yes, but no BFU (before first unlock) state<span class="tooltiptext">IodeOS has a disabled-by-default port of an older GrapheneOS implementation of the auto-reboot feature, which was determined to not be as robust due to being able to bypass it by crashing <code>system_server</code>. It also lacks the memory clearing required to get the device properly back at rest for reboots. Therefore it can't return the device to a proper BFU (before first unlock) state like the GrapheneOS and iOS implementations.</span></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="lred tooltip">Advanced Protection mode, but no BFU state<span class="tooltiptext">If Advanced Protection Mode is enabled, it provides a 72 hour auto-reboot timer. However, it appears to lack memory zeroing and therefore can't return the device to a proper BFU (before first unlock) state like the GrapheneOS and iOS implementations. It is unclear if the implementation is protected from a core system process crashing (<code>system_server</code>) preventing a trigger of the auto-reboot.</span></td>
</tr>
<tr>
<td class="legend">2-factor fingerprint unlock</td>
<td class="green">Yes (fingerprint + PIN), <a href="https://discuss.grapheneos.org/d/18585-2-factor-fingerprint-unlock-feature-is-now-fully-implemented" target="_blank">see here</a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend tooltip">PIN scrambling<span class="tooltiptext">Randomize position of digits on the lockscreen in order to reduce shoulder-surfing and smudge pattern attacks by preventing observers from learning your PIN based on button positions.</span></td>
<td class="green">Yes, <a href="https://grapheneos.org/features#pin-scrambling" target="_blank">see here</a></td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="red">No</td>
<td class="green">Yes</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Hardened system components</td>
<td class="green">Yes, hardened memory allocator, kernel, libc, webview (Vanadium), SELinux policy, and additional hardening. <a href="https://grapheneos.org/features" target="_blank">See here</a></td>
<td class="red">No (same as AOSP)</td>
<td class="red">No (same as AOSP)</td>
<td class="red">No (same as AOSP)</td>
<td class="red">No (same as AOSP)</td>
<td class="red">No (same as AOSP)</td>
</tr>
<tr>
<td class="legend semititle"><br />Updates</td>
<td></td><td></td><td></td><td></td><td></td><td></td>
</tr>
<tr>
<td class="legend tooltip">Security preview releases<span class="tooltiptext">Since 2025 H2, Google will distribute security patches to OEMs (phone manufacturers) 3-4 months before the "official" publication date. Until that date, they are not allowed to publish source codes or details, but it is allowed to publish the binaries and list the fixed CVEs. This change in Google's policy delays getting patches to users and sophisticated attackers will have no issue getting the patches from one of many people at Android OEMs with early access. It furthermore restricts the ability of open source and non-commercial Android distributions to patch security issues on time as the security patches are only distributed to official OEMs and it is not allowed to republish the source code before the embargo ends.</span></td>
<td class="green tooltip">Yes (optional)<span class="tooltiptext">Users can opt in to security patches that are still under the embargo for source code and details. Thanks to a cooperation with an Android OEM, GrapheneOS is able to ship these security patches as binaries before the "offical" publication date. However, the patches can't be included in the regular open-source releases until the embargo ends.</span></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red tooltip">No<span class="tooltiptext">As of September 2025, No OEMs are actually publishing updated binaries during the embargo period despite Google's policy allowing a "binary-only exception" to ship patches earlier. This exception exists in theory to allow shipping binary-only patches without the typical source code embargo delay, but it is not being used in practice by OEMs, including Google for Pixels.</span></td>
</tr>
<tr>
<td class="legend tooltip">Security update speed (AOSP subset of ASB)<span class="tooltiptext">It doesn't explain how the device-specific patches in the second half of each Android Security Bulletin are actually delivered, or if they ever make it to end users. Since autumn 2025, Google no longer publishes all security fixes immediately into AOSP each month. Instead, they distribute patches under embargo to OEMs, and the corresponding changes only appear publicly in the source code 3–4 months later. This means that full security patching now depends even more on keeping up with your vendor's own releases, because relying on AOSP directly will always leave you months behind. Falling behind on quarterly or yearly OEM releases results in missing many security fixes until the next major release for that device. The situation varies greatly: Pixels still set the standard because Pixel updates track the embargoed patches promptly, while many vendors are slow to roll out quarterly or yearly releases. Some devices that fail to ship a timely new Android version make it almost impossible for an alternate OS to provide complete patches. If the vendor doesn't ship updated firmware or drivers, alternate OS projects have no path to apply those fixes themselves. For example, Fairphone historically trailed by 1–2 months even before the embargo change, and therefore projects like CalyxOS or LineageOS on Fairphone remain at least that far behind.<br /><a href="https://web.archive.org/web/20240328045058/https://divestos.org/misc/a-dates.txt" target="_blank" style="color: white;">Click here for update speed data</a></span></td>
<td class="green">Usually same day</td>
<!--<td class="lgreen">Days to weeks</td>--><td class="red"><a href="https://calyxos.org/news/2025/08/01/a-letter-to-our-community/" target="_blank">Currently no updates</td>
<td class="yellow">2-4 weeks, sometimes longer</td>
<td class="lred">1-2 months, sometimes longer</td>
<td class="lgreen">1-2 weeks, sometimes longer</td>
<td>Depends on phone vendor</td>
</tr>
<tr>
<td class="legend tooltip">Full patches on fully supported devices<span class="tooltiptext">Requires 1. being on the latest OS release (as Android doesn't backport all security patches), 2. shipping all the vendor code</span></td>
<td class="green">Several days</td>
<!--<td class="lgreen">Weeks to months</td>--><td class="red"><a href="https://calyxos.org/news/2025/08/01/a-letter-to-our-community/" target="_blank">Currently no updates</td>
<td class="yellow">Several to many months</td>
<td class="lred">Many months to over a year</td>
<td class="yellow">Several to many months</td>
<td>Depends on phone vendor</td>
</tr>
<tr>
<td class="legend tooltip">Partial security updates (ASB) after EoL date<span class="tooltiptext">missing most driver and firmware patches after the phone's end of life date</span></td>
<td class="lgreen tooltip">until 5 years from launch<span class="tooltiptext">e.g. 2 years of extended support for 4th and 5th generation Pixels</span></td>
<!--<td class="lgreen">1-3 years</td>--><td class="red"><a href="https://calyxos.org/news/2025/08/01/a-letter-to-our-community/" target="_blank">Currently no updates</td>
<td class="green">Several years</td>
<td class="green">Several years</td>
<td class="green">Several years</td>
<td class="red">By definition: No</td>
</tr>
<tr>
<td class="legend tooltip">Number of Android versions supported<span class="tooltiptext">Only the latest major release of AOSP has full security patches. Most privacy fixes are in fact only included for the new OS versions, not in the security patches. The ASB patches patches rarely include fixes for permission model / sandbox flaws resulting in privacy leaks since they're given Moderate severity and often require invasive changes including potential compatibility breaks.</span></td>
<td>Usually 1 Android version</td>
<!--<td>Usually 1 Android version</td>--><td class="red"><a href="https://calyxos.org/news/2025/08/01/a-letter-to-our-community/" target="_blank">Currently no updates</td>