1

Tags:

• 2026012800 (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold, Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a, Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, emulator, generic, other targets)

Changes since the 2026012100 release:

• FusedLocationProvider: restore pre-16-QPR1 GNSS usage policy of using GNSS for both balanced and high power requests instead of only high power requests since many GrapheneOS users don’t enable network location and network location may not always be accessible such as temporarily not having internet access
• Sandboxed Google Play compatibility layer: add special case for sandboxed Play services making it so users granting the SMS permission enables reading SMS addressed to apps using the Google Play services client library (Android 16 QPR2 prevented using the SMS permission to read SMS addressed to other apps so a special case is needed for apps which use Google Play services to handle SMS-based authentication)
• Sandboxed Google Play compatibility layer: prevent sandboxed Play Store attempting to install the “Device configuration” package which is not used on GrapheneOS and serves no purpose
• avoid compatibility issues with apps doing misguided anti-tampering checks by changing the initial call stack for secure app spawning (exec spawning) to match the standard zygote-based spawning
• Settings: require device restart after changing the secure app spawning setting
• Sandboxed Google Play compatibility layer: update Android Auto configuration UI to Material 3 Expressive
• add workaround for upstream system_server startUserInBackgroundTemporarily crash
• fix GrapheneOS support for recording permission usage history for a broader set of permissions
• Dialer: set CallStyle for call notifications to improve the user interface and replace our temporary workaround of disabling notification grouping for it
• Network Location: rename “GrapheneOS proxy” option to “GrapheneOS Apple proxy” for clarity
• Network Location: add “Apple China” server choice required for China data due to China’s laws about mapping the country (currently no proxy due to poor connectivity to and from China causing reliability issues with connecting to Apple’s servers in China from ours but we plan to offer it as an option in the future)
• Pixel 8a, 9th gen Pixels and 10th gen Pixels: disable NTP usage in Samsung gnssd which isn’t as useful on GrapheneOS due to reducing the system time update threshold from 2000ms to 50ms along with avoiding us needing to redirect this to our own NTP service as we did for Qualcomm xtra-daemon
• update code for disabling reporting of harmless fingerprint-service.goodix crash
• improve user interface for Network/Sensors permissions in the permission manager
• fix minor Material 3 Expressive styling issues for the Contact Scopes and Storage Scopes configuration UI
• adevtool: raise minimal supported Node.js version to 24
• adevtool: disallow running adevtool as root
• adevtool: check for presence of prebuilts dirs at startup
• kernel (6.12): update to latest GKI LTS branch revision including update to 6.12.67
• Vanadium: update to version 144.0.7559.109.0

All of the Android 16 security patches from the current February 2026, March 2026, April 2026, May 2026 and June 2026 Android Security Bulletins are included in the 2026012801 security preview release. List of additional fixed CVEs:

• Critical: CVE-2026-0039, CVE-2026-0040, CVE-2026-0041, CVE-2026-0042, CVE-2026-0043, CVE-2026-0044, CVE-2026-0047, CVE-2026-0049
• High: CVE-2025-22424, CVE-2025-22426, CVE-2025-32348, CVE-2025-48600, CVE-2025-48615, CVE-2025-48617, CVE-2025-48630, CVE-2025-48641, CVE-2025-48642, CVE-2025-48644, CVE-2025-48645, CVE-2025-48646, CVE-2025-48649, CVE-2025-48652, CVE-2025-48653, CVE-2025-48654, CVE-2026-0011, CVE-2026-0014, CVE-2026-0015, CVE-2026-0016, CVE-2026-0017, CVE-2026-0018, CVE-2026-0020, CVE-2026-0021, CVE-2026-0022, CVE-2026-0023, CVE-2026-0024, CVE-2026-0025, CVE-2026-0033, CVE-2026-0034, CVE-2026-0035, CVE-2026-0036, CVE-2026-0048, CVE-2026-0050

For detailed information on security preview releases, see our post about it.