The relationship between the open-source project GrapheneOS and Google has become strained once again. This time, the reason isn't a simple design disagreement, but a direct accusation: the Mountain View company is allegedly withholding key features of Android 17 QPR1, including both APIs and security patches, to keep them exclusive to its Pixel phones. Other manufacturers and custom ROMs would have to wait months to access this code, leaving many users unprotected against critical vulnerabilities.
GrapheneOS, known for its focus on privacy and security, has decided to speak out through its team. After analyzing the latest quarterly Android update, the group discovered that Google has not released a series of APIs and bug fixes in the Android Open Source Project (AOSP) that are present in the version received by Pixel devices. This situation, unseen since Android Honeycomb, represents a shift in ecosystem transparency and opens a debate about Google's anti-competitive practices.
The controversy surrounding Android 17 QPR1 and AOSP
According to the GrapheneOS team, Android 17 QPR1 is the first version since Android Honeycomb (3.x) to incorporate new developer APIs without simultaneously releasing them to AOSP. These APIs are, for now, exclusive to the Pixel operating system, meaning other brands cannot use or adapt them. Official Android documentation already shows differences between Android 17 and Android 17 QPR1, and although Google has provided screenshots of the developer version, this does not resolve the issue of access to the source code.
The project claims it had successfully adapted its code to Android 17 QPR1 a few weeks before the September 15th release, but cannot distribute it because it lacks permission to publish certain components. This forces them to reverse-engineer the Pixel firmware to transfer the fixes to their system, a time-consuming and resource-intensive task. The lack of transparency in AOSP not only affects GrapheneOS, but any developer or manufacturer wishing to offer their own version of Android.
The problem isn't limited to APIs. GrapheneOS has also pointed out that the September Pixel security bulletin includes additional patches for vulnerabilities affecting standard Android platform components. These same vulnerabilities are also present in devices from other manufacturers, but they don't appear in the general Android security bulletin published by Google. This means Pixel devices would receive these fixes in September, while other manufacturers would have to wait until December with Android 17 QPR2, leaving many users vulnerable.
Security patches and competitive advantage for Pixel
GrapheneOS considers this practice "highly questionable" and believes it gives Google an unfair competitive advantage over its own OEM partners. In their view, Google should not restrict access to the platform's standard code, as this slows the adoption of security improvements across the ecosystem. In fact, the project has even questioned whether Google's legal team is aware of what is happening, hinting at potential legal implications.
GrapheneOS's response was swift. To mitigate this situation, the group confirmed it is working on backward compatibility for Pixel firmware, drivers, and HALs from Android 17 QPR1 to Android 17. It also announced a collaboration with Motorola for future devices, expected in 2027, that will use Snapdragon processors. This partnership would allow GrapheneOS to access official firmware and driver code, simplifying the development and distribution of its system. Thus, Pixel phones, which for years were the only devices recommended by the project, could lose that status if Google continues with this exclusivity policy.
Meanwhile, the debate over Android's openness continues. Google has yet to respond to the accusations, but GrapheneOS's decision to seek alternatives from Motorola demonstrates that trust in Google's hardware has eroded. The ball is now in Mountain View's court, and time will tell whether this controversy remains a mere exchange of accusations or leads to a real change in Android's code release policy.
Secure Paste: an additional privacy feature
Amid this controversy, GrapheneOS has also announced the integration of Secure Paste, a feature that allows users to paste content to the clipboard without applications being able to read it. This feature replaces API-based clipboard access, which the project considers problematic because it allows invasive applications to read sensitive data such as passwords or one-time codes. Secure Paste adds a secure paste button to the standard keyboard and integrates with accessibility and shortcut services. With this tool, GrapheneOS users can prevent third-party apps from automatically accessing their clipboard, another step in their fight for privacy.
Ultimately, GrapheneOS has brought to the forefront a problem that transcends its own project: to what extent can Google withhold security updates for its Pixel devices without the rest of the ecosystem noticing? The company hasn't offered its side of the story, but GrapheneOS's decision to target Motorola makes it clear that trust in Google's hardware has eroded. Meanwhile, Android users of other brands are wondering if their data will be protected to the same degree as Pixel users, or if they'll have to wait months for patches that should already be available to everyone. The community, at least, now has a new tool to protect its clipboard with Secure Paste, but the battle for Android transparency seems far from over.
