-
Notifications
You must be signed in to change notification settings - Fork 19
/
Copy pathandroid_comparison.htm
1151 lines (1001 loc) · 53.8 KB
/
android_comparison.htm
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<!DOCTYPE html>
<html>
<head>
<title>Comparison of Android-based Operating Systems</title>
<meta name="description" content="Comparison of Android-based Operating Systems">
<meta name="viewport" content="width=device-width, initial-scale=1">
<meta charset="UTF-8">
<meta name="keywords" content="Technology, Browsers, Firefox, Chrome, Edge, Safari, Brave, Vivaldi, Operating Systems, Desktop Environments, GNOME, KDE, Xfce, Linux, Unix, BSD, Solaris, Windows, macOS, Instant Messengers, Chat, Software, Cloud, Sync, Email, Privacy">
<meta name="author" content="Alphonse Eylenburg">
<link rel="stylesheet" href="style.css">
<style>
:root {
--legendwidth: 280px;
--distrowidth: 268px;
}
table.comparison {
margin-top: 1em;
text-align: center;
border: none;
table-layout: fixed;
font-size: small;
width: calc(var(--legendwidth) + 6 * var(--distrowidth));
height: 100%;
}
table.comparison tr td:nth-child(2) {
border-left: 1px dotted lightgrey;
}
table.appendix {
text-align: center;
table-layout: fixed;
width: 100%;
font-size: small;
}
table.appendix td {
border: 1px solid #ddd;
overflow-wrap: break-word;
width: 25%;
}
table.appendix td:first-child {
text-align: left;
}
table.appendix thead {
position: sticky;
position: -webkit-sticky;
top: 0px;
z-index: 10;
font-size: small;
}
thead {
border: none;
position: sticky;
position: -webkit-sticky;
top: 0px;
z-index: 10;
font-size: large;
}
thead tr td {
background-color: white;
font-weight: bold;
}
@media (prefers-color-scheme: dark) {
thead tr td, .legend {background-color: #222 !important; color: white; }
}
td {
border: none;
padding: 0px;
vertical-align: top;
overflow-wrap: break-word;
hyphens: auto;
}
td img {
padding: 15px 0px;
}
.semititle {
text-decoration: underline;
font-weight: bold;
vertical-align: bottom; }
.legend {
text-align: left;
white-space: nowrap;
padding-right: 5px;
background-color: white;
}
.center {
text-align: center;
}
.tooltip {
text-decoration: underline;
text-decoration-style: dotted;
text-decoration-color: darkred;
z-index: 99999;
}
.tooltip .tooltiptext {
visibility: hidden;
background-color: black;
color: #fff;
text-align: center;
border-radius: 6px;
padding: 5px 5px;
position: absolute;
}
.tooltip:hover .tooltiptext {
visibility: visible;
font-weight: normal;
}
.green {
background-color: #CEE6BB;
}
.lgreen {
background-color: #E7F2DD;
}
.yellow {
background-color: #E7DEB1;
}
.lred {
background-color: #F5E0D6;
}
.red {
background-color: #EBC1AD;
}
.blue {
background-color: aliceblue;
}
img.logo {
max-width: 150px;
max-height: 75px;
}
@media (prefers-color-scheme: dark) {
#grapheneos-logo {
filter: invert(88%);
}
}
td.green,
td.lgreen,
td.red,
td.lred,
td.yellow,
td.blue,
td.line {
border-top: 1px solid ivory;
border-bottom: 1px solid ivory;
}
@media (prefers-color-scheme: dark) {
td.green, td.lgreen, td.red, td.lred, td.yellow, td.blue { color: black; }
}
@media (min-width: 578px){
.legend {
position: -webkit-sticky;
position: sticky;
left: 0;
}
}
sup {
font-size: x-small;
}
</style>
<body>
<script src="top.js"></script>
<header>
<p><a href="index.html">← Sitemap</a></p>
</header>
<h1>Comparison of Android-based Operating Systems</h1>
<p>This is a comparison of popular Android "ROMs" (better term: AOSP distributions or Android-based OS). Please note I'm not affiliated with any of these projects and I am not giving any specific recommendation. If you think anything is factually incorrect, please let me know.</p>
<p>DivestOS was originally included in this comparison but it was discontinued at the end of 2024. <a href="old/android_comparison_2024old.htm"><strong>For an older version of this comparison which includes DivestOS, please see here.</a></strong></p>
<h2 class="center">Comparison of Android-based Operating Systems</h2>
<p class="center">Source: eylenburg.github.io</p>
<p class="center" style="color: red; font-size: small;">Last updated: 13 March 2025</p>
<table class="comparison">
<colgroup>
<col style="text-align: left; white-space: nowrap; padding-right: 5px; width: var(--legendwidth);"> <!-- legend -->
<col style="border-left: double; width: var(--distrowidth);">
<col style="border-left: 1px solid lightgrey; width: var(--distrowidth);">
<col style="border-left: 1px solid lightgrey; width: var(--distrowidth);">
<col style="border-left: 1px solid lightgrey; width: var(--distrowidth);">
<col style="border-left: 1px solid lightgrey; width: var(--distrowidth);">
<col style="border-left: 1px solid lightgrey; width: var(--distrowidth);">
<thead>
<tr>
<td class="legend"></td>
<td>GrapheneOS</td>
<td>CalyxOS</td>
<td>IodéOS</td>
<td>/e/</td>
<td>LineageOS</td>
<td>"Stock" Android</td>
</tr>
</thead>
<tbody>
<tr>
<td class="legend"></td>
<td><img class="logo" id="grapheneos-logo" src="pics/logos/android/grapheneos.svg" /></td>
<td style="vertical-align: middle;"><img class="logo" src="pics/logos/android/calyxos.jpg" /></td>
<td style="vertical-align: middle;"><img class="logo" src="pics/logos/android/iodeos.png" /></td>
<td><img class="logo" src="pics/logos/android/eos.png" /></td>
<td style="vertical-align: middle;"><img class="logo" src="pics/logos/android/lineageos.png" /></td>
<td style="vertical-align: middle;"><img class="logo" src="pics/logos/android/android.svg" /></td>
</tr>
<tr>
<td class="legend">Based on</td>
<td>AOSP</td>
<td>AOSP</td>
<td>LineageOS</td>
<td>LineageOS</td>
<td>AOSP</td>
<td>AOSP</td>
</tr>
<tr>
<td class="legend semititle"><br />Freedom</td>
<td></td><td></td><td></td><td></td><td></td><td></td>
</tr>
<tr>
<td class="legend">Free and open source (FOSS)?</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Deblobbed?</td>
<td class="lgreen">Yes, significantly</td>
<td class="lgreen">Yes, significantly</td>
<td class="yellow">Yes, minimal</td>
<td class="yellow">Yes, minimal</td>
<td class="yellow">Yes, minimal</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend semititle"><br />Features</td>
<td></td><td></td><td></td><td></td><td></td><td></td>
</tr>
<tr>
<td class="legend tooltip">Network controls for apps<span class="tooltiptext">The controls on LineageOS-based operating systems are leaky as their approach only disabled direct network access (socket) but doesn't disable indirect access via the INTERNET permission, which provides multiple ways of bypassing them not requiring collusion between apps. This functionality is regularly used by apps with no malicious intent. Collusion between apps is an issue for all kinds of granted access, permissions, etc. and not specific to the INTERNET permission. If INTERNET permission is not blocked though, no collusion is required.</span></td>
<td class="green">Direct and indirect access</td>
<td class="lgreen">Direct access only</td>
<td class="lgreen">Direct access only</td>
<td class="lgreen">Direct access only</td>
<td class="lgreen">Direct access only</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Network-based location (without GNSS)</td>
<td class="green tooltip">Opt-in with server choice<span class="tooltiptext">Network-based location is disabled by default (GNSS-based location is used instead), but if it is enabled the user can choose between the Apple location service or a GrapheneOS proxy to it, or alternatively can use the Google Play location service if sandboxed Google Play is installed</span></td>
<td class="green">Yes, using microG location</td>
<td class="green">Yes, using microG location</td>
<td class="green">Yes, using microG location</td>
<td class="red">No</td>
<td class="green">Yes, using Play Services</td>
</tr>
<tr>
<td class="legend">System-wide connection/tracker blocking</td>
<td class="green">Private DNS setting, or via VPN app</td>
<td class="green">Private DNS setting, or via VPN app</td>
<td class="green">iode-snort app, Private DNS, or VPN</td>
<td class="green">Private DNS setting, or via VPN app</td>
<td class="green">Private DNS setting, or via VPN app</td>
<td class="green">Private DNS setting, or via VPN app</td>
</tr>
<tr>
<td class="legend">E2E-encrypted phone backups</td>
<td class="green">Yes (Seedvault)</td>
<td class="green">Yes (Seedvault)</td>
<td class="green">Yes (Seedvault)</td>
<td class="green">Yes (Seedvault)</td>
<td class="green">Yes (Seedvault)</td>
<td class="yellow">Yes, but requires Google login</td>
</tr>
<tr>
<td class="legend">Notification forwarding from other user profiles</td>
<td class="green">Yes</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Duress PIN (to wipe device)</td>
<td class="green">Yes, <a href="https://grapheneos.org/features#duress" target="_blank">see here</a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Android Auto compatible</td>
<td class="green tooltip">Yes (sandboxed), <a href="https://grapheneos.org/usage#android-auto" target="_blank">see here</a><span class="tooltiptext">GrapheneOS has permission toggles to enable the user to provide the least amount of permissions necessary (e.g. wired Android Auto requires only USB access).</span></td>
<td class="lgreen">Yes (w/ privileged permissions), <a href="https://calyxos.org/docs/guide/android-auto/" target="_blank">see here</a></td>
<td class="lgreen">Yes (w/ privileged permissions), <a href="https://blog.iode.tech/use-android-auto-with-iodeos/" target="_blank">see here</a></td>
<td class="lgreen">Yes (w/ privileged permissions), <a href="https://doc.e.foundation/support-topics/android-auto" target="_blank">see here</a></td>
<td class="red">No</td>
<td class="lgreen">Yes (w/ privileged permissions)</td>
</tr>
<tr>
<td class="legend">Google Pay compatible</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="lgreen">Yes (w/ privileged permissions)</td>
</tr>
<tr>
<td class="legend">Call recording</td>
<td class="green">Yes</td>
<td class="yellow">Only in selected regions, <a href="https://github.com/CalyxOS/platform_packages_apps_Dialer/blob/android13/java/com/android/dialer/callrecord/res/xml/call_record_states.xml" target="_blank">see here</a></td>
<td class="yellow">Only in selected regions, <a href="https://gitlab.com/iode/os/public/lineage/packages_apps_Dialer/-/blob/v3-staging/java/com/android/dialer/callrecord/res/xml/call_record_states.xml" target="_blank">see here</a></td>
<td class="yellow">Only in selected regions, <a href="https://gitlab.e.foundation/e/os/android_packages_apps_Dialer/-/blob/a14/java/com/android/dialer/callrecord/res/xml/call_record_states.xml" target="_blank">see here</a></td>
<td class="yellow">Only in selected regions, <a href="https://github.com/LineageOS/android_packages_apps_Dialer/blob/lineage-20.0/java/com/android/dialer/callrecord/res/xml/call_record_states.xml" target="_blank">see here</a></td>
<td class="yellow">Depends on regions and manufacturer</td>
</tr>
<tr>
<td class="legend semititle"><br />Degoogling (connections to Google)
<span class="tooltip"><span style-" style="font-size: 50%; color: blue;">COLOURS</span><span class="tooltiptext">LOGIC FOR COLOUR SCHEME:
<br /><br />
RED<br />
- connects to Google, no opt-out
<br /><br />
LIGHT RED<br />
- connects to Google by default but function can be turned off (no option of using another provider)
<br /><br />
YELLOW<br />
- function is off by default but can connect to Google if needed (no option of using another provider)
<br /><br />
LIGHT GREEN<br />
- connects to Google by default but can be changed to another provider
<br /><br />
GREEN<br />
- does not connect to Google by default but instead connects to the developer of the operating system (no third party needs to be trusted)<br />
- multiple providers offered and user can decide<br />
- no data shared with any provider
<br /><br />
BLUE<br />
- does not connect to Google by default but instead connects to another (non-Google) third party provider
<br /><br />
WHITE<br />
- function is not supported</span></span></td>
<td></td><td></td><td></td><td></td><td></td><td></td>
</tr>
<tr>
<td class="legend">eSIM activation</td>
<td class="green tooltip">Google eUICC w/o data sharing<span class="tooltiptext">Disabled by default. Unlike the regular Google eUICC management app, it doesn't require Google Play and cannot share data with it. It doesn't communicate with Google servers unless the carrier is hosting with them, which would involve using their servers regardless.</span></td>
<td class="red">Google eUICC (preinstalled)</td>
<td class="red">Google eUICC (preinstalled)</td>
<td class="red">Google eUICC (preinstalled)</td>
<td class="red">Google eUICC (preinstalled)</td>
<td class="red">Google eUICC (preinstalled)</td>
</tr>
<tr>
<td class="legend">Provider for network-based location</td>
<td class="green tooltip">None <sup>default</sup>, GrapheneOS, Apple, or Google<span class="tooltiptext">Network-based location is disabled by default (GNSS-based location is used instead), but if it is enabled the user can choose between the Apple location service or a GrapheneOS proxy to it, or alternatively can use the Google Play location service if sandboxed Google Play is installed</span></td>
<td class="green">microG location</td>
<td class="green">microG location</td>
<td class="green">microG location</td>
<td>n/a</td>
<td class="red">Google</td>
</tr>
<tr>
<td class="legend">SUPL (for Assisted GNSS)</td>
<td class="green">GrapheneOS <sup>default</sup>, Google or none</td>
<td class="lred">Google <sup>default</sup>, or none</td>
<td class="lred">Google <sup>default</sup>, or none</td>
<td class="yellow">None <sup>default</sup>, or Google</td>
<td class="lred">Google <sup>default</sup>, or none</td>
<td class="red">Google</td>
</tr>
<tr>
<td class="legend tooltip">PSDS/XTRA <span style="font-size: 75%;">("Standard" depends on GPS chipset)</span><span class="tooltiptext">The standard server used depends on the GPS chipset, which is usually Qualcomm, Broadcom, or Samsung, or in the case of Tensor chips (Google Pixel 6 and later) they connect to a Google server. Some ROMs override these settings.<br /><a href="https://web.archive.org/web/20250111112822/https://divestos.org/misc/gnss.txt" target="_blank" style="color: white;">Click here for details and which device information are sent.</a></span></td>
<td class="green">GrapheneOS <sup>default</sup>, <span class="tooltip">Standard<span class="tooltiptext">Google / Broadcom / Qualcomm / Samsung depending on the device. At the moment, only Google Pixels are supported by GrapheneOS, for which the standard connection is Google (since the Pixel 6)</span></span>, or none</td>
<td class="blue"><span class="tooltip">Standard (excl. Google)<span class="tooltiptext">Broadcom / Qualcomm / Samsung depending on the device, for Google Pixel 6 and later (Tensor chip) the standard connection to Google is replaced with a connection to Broadcom instead <a href="https://www.kuketz-blog.de/calyxos-de-googled-geht-anders-custom-roms-teil2/" target="_blank">(source)</a></span></span> <sup>default</sup>, or none</td>
<td class="blue"><span class="tooltip">Standard (excl. Google)<span class="tooltiptext">Broadcom / Qualcomm / Samsung depending on the device, for Google Pixel 6 and later (Tensor chip) the standard connection to Google is replaced with a connection to Broadcom instead <a href="https://www.kuketz-blog.de/iodeos-datenschutzfreundlich-aber-abstriche-bei-der-sicherheit-custom-roms-teil3/" target="_blank">(source)</a></span></span> <sup>default</sup>, or none</td>
<td class="yellow">None <sup>default</sup>, or <span class="tooltip">Standard<span class="tooltiptext">Google / Broadcom / Qualcomm / Samsung depending on the device</span></span></td>
<td class="lred"><span class="tooltip">Standard<span class="tooltiptext">Google / Broadcom / Qualcomm / Samsung depending on the device</span></span> <sup>default</sup>, or none</td>
<td class="red"><span class="tooltip">Standard<span class="tooltiptext">Google / Broadcom / Qualcomm / Samsung depending on the device</span></span></td>
</tr>
<!--
<tr>
<td class="legend tooltip">PSDS - Google Pixel 6 and later (Tensor SoC)<span class="tooltiptext">The default server used depends on the GPS chipset, e.g. phones with Qualcomm chips (e.g. Snapdragon) connect to a Qualcomm server, while newer Google Pixels with Tensor chips connect to a Google server, and other phones with Broadcom GPS (e.g. Exynos) connect to a Broadcom server. Some ROMs override these settings. <br /><a href="https://web.archive.org/web/20250111112822/https://divestos.org/misc/gnss.txt" target="_blank" style="color: white;">Click here for details and which device information are sent.</a></span></td>
<td class="green">GrapheneOS <sup>default</sup>, Google, or none</td>
<td class="blue">Broadcom <sup>default</sup>, or none</td>
<td class="blue">Broadcom <sup>default</sup>, or none</td>
<td class="yellow">None <sup>default</sup>, or Google</td>
<td class="lred">Google <sup>default</sup>, or none</td>
<td class="red">Google</td>
</tr>
<tr>
<td class="legend tooltip">PSDS - other phones (no Tensor SoC)<span class="tooltiptext">The default server used depends on the GPS chipset, e.g. phones with Qualcomm chips (e.g. Snapdragon) connect to a Qualcomm server, while newer Google Pixels with Tensor chips connect to a Google server, and other phones with Broadcom GPS (e.g. Exynos) connect to a Broadcom server. Some ROMs override these settings. <br /><a href="https://web.archive.org/web/20250111112822/https://divestos.org/misc/gnss.txt" target="_blank" style="color: white;">Click here for details and which device information are sent.</a></span></td>
<td class="green">GrapheneOS <sup>default</sup>, Standard (Qualcomm/Broadcom/Samsung), or none</td>
<td class="blue">Standard (Qualcomm/Broadcom/Samsung) <sup>default</sup>, or none</td>
<td class="blue">Standard (Qualcomm/Broadcom/Samsung) <sup>default</sup>, or none</td>
<td class="yellow">None <sup>default</sup>, or Standard (Qualcomm/Broadcom/Samsung)</td>
<td class="blue">Standard (Qualcomm/Broadcom/Samsung) <sup>default</sup>, or none</td>
<td class="blue">Standard (Qualcomm/Broadcom/Samsung)</td>
</tr>
-->
<tr>
<td class="legend">Connectivity check/captive portal</td>
<td class="green">GrapheneOS <sup>default</sup>, Google, or none</td>
<td class="lgreen"><span class="tooltip">Google (can be changed)<span class="tooltiptext">can be changed with `adb` command</span></span></td>
<td class="blue"><span class="tooltip">Kuketz.de (can be changed)<span class="tooltiptext">can be changed with `adb` command</span></span></td>
<td class="green"><span class="tooltip">Murena.io (related to /e/) (can be changed)<span class="tooltiptext">can be changed with `adb` command</span></span></td>
<td class="lgreen"><span class="tooltip">Google (can be changed)<span class="tooltiptext">can be changed with `adb` command</span></span></td>
<td class="lgreen"><span class="tooltip">Google (can be changed)<span class="tooltiptext">can be changed with `adb` command</span></span></td>
</tr>
<tr>
<td class="legend">DNS connectivity check</td>
<td class="green">GrapheneOS <sup>default</sup>, or Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
</tr>
<tr>
<td class="legend">DNS server fallback</td>
<td class="blue">Cloudflare</td>
<td class="blue">Cloudflare</td>
<td class="blue">Quad9</td>
<td class="blue">Quad9</td>
<td class="red">Google</td>
<td class="red">Google</td>
</tr>
<tr>
<td class="legend">Network time</td>
<td class="green">GrapheneOS <sup>default</sup>, or none</td>
<td class="lgreen"><span class="tooltip">Google (can be changed)<span class="tooltiptext">can be changed with `adb` command</span></span> & carrier</td>
<td class="blue"><span class="tooltip">NTP.org (can be changed)<span class="tooltiptext">Server pool with arbitrary providers, which can include Google-hosted servers or even malicious servers. NTP server can be changed with `adb` command.</span></span> & carrier</td>
<td class="blue"><span class="tooltip">NTP.org (can be changed)<span class="tooltiptext">Server pool with arbitrary providers, which can include Google-hosted servers or even malicious servers. NTP server can be changed with `adb` command.</span></span> & carrier</td>
<td class="lgreen"><span class="tooltip">Google (can be changed)<span class="tooltiptext">can be changed with `adb` command</span></span> & carrier</td>
<td class="lgreen"><span class="tooltip">Google (can be changed)<span class="tooltiptext">can be changed with `adb` command</span></span> & carrier</td>
</tr>
<tr>
<td class="legend">Hardware attestation provisioning</td>
<td class="green">GrapheneOS <sup>default</sup>, or Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
</tr>
<tr>
<td class="legend">DRM (Widevine) provisioning</td>
<td class="green">GrapheneOS <sup>default</sup>, or Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
<td class="red">Google</td>
</tr>
<tr>
<td class="legend semititle"><br />Google Play Services</td>
<td></td><td></td><td></td><td></td><td></td><td></td>
</tr>
<tr>
<td class="legend">Implementation</td>
<td class="tooltip">GmsCompat (sandboxed Google Play)<span class="tooltiptext">GrapheneOS does not include Google Play as a preinstalled app, but it includes an open source compatibility layer for users who choose to use it. Users can alternatively install microG on GrapheneOS, albeit GrapheneOS does not support signature spoofing. Not all microG functionality requires signature spoofing, for example FCM works with microG without signatures spoofing to the extent it works without special privileges (e.g. microG needs to use a privileged API to wake apps and keep them awake for a short period of time to handle FCM messages).</span></td>
<td>microG</td>
<td>microG</td>
<td>microG</td>
<td rowspan="8">None by default. It's possible to install microG manually (LineageOS <a href="https://review.lineageos.org/c/LineageOS/android_frameworks_base/+/383574" target="_blank">supports signature spoofing for microG</a> since 2024). Alternatively, there are <a href="https://lineage.microg.org/" target="_blank">ROMs with microG preinstalled</a> or one can <a href="https://wiki.lineageos.org/gapps" target="_blank">add Google apps</a> during the installation process, but this is not officially supported by LineageOS. <!--Alternatively, there is the <a href="https://lineage.microg.org/" target="_blank">LineageOS for microG</a> project that integrates microG in LineageOS.</td>-->
<td>Google Play Services</td>
</tr>
<tr>
<td class="legend">Optional?</td>
<td class="green">Yes (not preinstalled)</td>
<td class="green">Yes (preinstalled but opt-out)</td>
<td class="green">Yes (preinstalled but opt-out)</td>
<td class="red">No (preinstalled without opt-out)</td>
<!-- skipped -->
<td class="red">No (preinstalled without opt-out)</td>
</tr>
<tr>
<td class="legend">Runs in standard app sandbox?</td>
<td class="green">Yes</td>
<td class="red tooltip">No<span class="tooltiptext">Runs in the `priv_app` SELinux domain instead of `untrusted_app`, which gives it access to internal system APIs and data along with it being much less isolated.</span></td>
<td class="red tooltip">No<span class="tooltiptext">Runs in the `priv_app` SELinux domain instead of `untrusted_app`, which gives it access to internal system APIs and data along with it being much less isolated.</span></td>
<td class="red tooltip">No<span class="tooltiptext">Runs in the `priv_app` SELinux domain instead of `untrusted_app`, which gives it access to internal system APIs and data along with it being much less isolated.</span></td>
<!-- skipped -->
<td class="red tooltip">No<span class="tooltiptext">Runs in the `priv_app` SELinux domain instead of `untrusted_app`, which gives it access to internal system APIs and data along with it being much less isolated.</span></td>
</tr>
<tr>
<td class="legend">Can be limited to user or work profile?</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td>? (TBC)</td>
<td>? (TBC)</td>
<!-- skipped -->
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Signature spoofing needed/allowed?</td>
<td class="green">No</td>
<td class="lgreen">Only for Google signature</td>
<td class="lgreen">Only for Google signature</td>
<td class="lgreen">Only for Google signature</td>
<!-- skipped -->
<td class="green">No</td>
</tr>
<tr>
<td class="legend">Push notifications via Google FCM?</td>
<td class="green">Yes</td>
<td class="green">Optional</td>
<td class="green">Optional</td>
<td class="green">Optional</td>
<!-- skipped -->
<td class="green">Yes</td>
</tr>
<tr>
<td class="legend">Google Play Integrity?</td>
<td class="lgreen tooltip">Passes Basic Integrity only, <a href="https://grapheneos.org/usage#banking-apps" target="_blank">see here</a><span class="tooltiptext">Passes MEETS_BASIC_INTEGRITY but not MEETS_DEVICE_INTEGRITY or MEETS_STRONG_INTEGRITY which require a certification from Google.</td>
<td class="lgreen tooltip">Passes Basic Integrity only<span class="tooltiptext">microG v0.3.6.244735, which is part of CalyxOS since 2024-12-31, passes MEETS_BASIC_INTEGRITY but not MEETS_DEVICE_INTEGRITY or MEETS_STRONG_INTEGRITY which require a certification from Google.</td>
<td class="lred tooltip">No but basic integrity expected soon<span class="tooltiptext">microG v0.3.6.244735, released on 2024-12-23, passes MEETS_BASIC_INTEGRITY, but the latest release of IodeOS was on 2024-12-18. This needs to be updated once microG is updated in IodeOS.</td>
<td class="lred tooltip">No but basic integrity expected soon<span class="tooltiptext">microG v0.3.6.244735, released on 2024-12-23, passes MEETS_BASIC_INTEGRITY, but the latest release of /e/ was on 2024-12-17. This needs to be updated once microG is updated in /e/.</td>
<!-- skipped -->
<td class="green">Yes</td>
</tr>
<tr>
<td class="legend semititle"><br />Privacy</td>
<td></td><td></td><td></td><td></td><td></td><td></td>
</tr>
<tr>
<td class="legend">Storage scopes</td>
<td class="green">Yes, <a href="https://grapheneos.org/features#storage-scopes" target="_blank">see here</a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Contact scopes</td>
<td class="green">Yes, <a href="https://grapheneos.org/features#contact-scopes" target="_blank">see here</a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Per-app sensor controls</td>
<td class="green">Yes, <a href="https://grapheneos.org/features#sensors-permission-toggle" target="_blank">see here </a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Per-connection DHCP state flushing</td>
<td class="green">Yes</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">MAC address randomization</td>
<td class="green">Per connection, <a href="https://grapheneos.org/features#wifi-privacy" target="_blank">see here</a></td>
<td class="lgreen">Per network</td>
<td class="lgreen">Per network</td>
<td class="lgreen">Per network</td>
<td class="lgreen">Per network</td>
<td class="lgreen">Per network</td>
</tr>
<tr>
<td class="legend">SUPL: IMSI or phone number sent?</td>
<td class="green">No</td>
<td class="green">No</td>
<td class="green">No</td>
<td class="green">No</td>
<td class="green">No</td>
<td class="red">Yes</td>
</tr>
<tr>
<td class="legend tooltip">Qualcomm XTRA: user agent sent?<span class="tooltiptext">Only relevant for phones with Qualcomm GPS chips. Doesn't apply to Broadcom or Samsung. May include chipset serial number, device manufacturer and model, carrier, and Android version. <a href="https://divestos.org/misc/gnss.txt" target="_blank" style="color: white;">Click here for details and which device information are sent.</a></span></td>
<td class="green">No</td>
<td class="yellow tooltip">Partially (for Qualcomm chips)<span class="tooltiptext">Chipset serial number is stripped out but other less unique device information remain</span></td>
<td class="yellow tooltip">Partially (for Qualcomm chips)<span class="tooltiptext">Chipset serial number is stripped out but other less unique device information remain</span></td>
<td class="yellow tooltip">Partially (for Qualcomm chips)<span class="tooltiptext">Chipset serial number is stripped out but other less unique device information remain</span></td>
<td class="yellow tooltip">Partially (for Qualcomm chips)<span class="tooltiptext">Chipset serial number is stripped out but other less unique device information remain</span></td>
<td class="lred">for Qualcomm GPS chips</td>
</tr>
<tr>
<td class="legend">Closed cross-profile package leaks?</td>
<td class="green">Yes</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Closed device identifier leaks?</td>
<td class="green">Yes, <a href="https://grapheneos.org/features#closed-device-identifier-leaks" target="_blank">see here</a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Metadata stripping for screenshots</td>
<td class="green">Yes, <a href="https://grapheneos.org/features#private-screenshots" target="_blank">see here </a></td>
<td class="green">Yes, <a href="https://calyxos.org/news/2023/10/04/october-security-update/" target="_blank">see here </a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">EXIF metadata stripping for photos</td>
<td class="green">Yes, <a href="https://grapheneos.org/usage#grapheneos-camera-app" target="_blank">see here </a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="yellow">Available as option</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Location tagging for photos</td>
<td class="green">Opt-in</td>
<td class="green">Opt-in, <a href=https://calyxos.org/docs/guide/security/location/#exif-metadata" target="_blank">see here for more info</a></td>
<td class="green">Opt-in</td>
<td class="green">Opt-in</td>
<td class="green">Opt-in</td>
<td class="lgreen">Opt-out</td>
</tr>
<tr>
<td class="legend">Tracking through Android Advertising ID?</td>
<td class="green tooltip">Not part of the system<span class="tooltiptext">if Play Services are installed by the user, the Advertising ID can be deleted in settings</span></td>
<td class="green tooltip">Randomized ID<span class="tooltiptext">microG will generate a random advertising ID for each request</span></td>
<td class="green tooltip">Randomized ID<span class="tooltiptext">microG will generate a random advertising ID for each request</span></td><td class="green tooltip">Randomized ID<span class="tooltiptext">microG will generate a random advertising ID for each request</span></td>
<td class="green tooltip">Not part of the system<span class="tooltiptext">if microG is installed by the user, it will generate a random Advertising ID for each request; if Play Services are installed by the user, the Advertising ID can be deleted in settings</span></td>
<td class="lgreen">Yes, but can be deleted in settings</td>
</tr>
<tr>
<td class="legend semititle"><br />Security</td>
<td></td><td></td><td></td><td></td><td></td><td></td>
</tr>
<tr>
<td class="legend">Verified boot (if supported by device)?</td>
<td class="green">Yes, incl. system app updates</td>
<td class="yellow">Yes, but excl. system app updates</td>
<td class="yellow">Yes, but excl. system app updates</td>
<td class="lred">w/ test keys; excl. system app updates</td>
<td class="red">No</td>
<td class="yellow">Yes, but excl. system app updates</td>
</tr>
<tr>
<td class="legend">Hardware-based security verification</td>
<td class="green">Yes, <a href="https://grapheneos.org/features#auditor" target="_blank"> see here</a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="yellow">Some devices, <a href="https://attestation.app/about" target="_blank">see here</a></td>
</tr>
<tr>
<td class="legend">System app downgrade protection</td>
<td class="green">For updates and boot, with fs-verity</td>
<td class="red">For updates (incomplete)</td>
<td class="red">For updates (incomplete)</td>
<td class="red">For updates (incomplete)</td>
<td class="red">For updates (incomplete)</td>
<td class="red">For updates (incomplete)</td>
</tr>
<tr>
<td class="legend">Secure application spawning?</td>
<td class="green">Yes (exec)</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Hardened memory allocator?</td>
<td class="green">Yes</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Hardware memory tagging?</td>
<td class="green">Yes, if supported by device</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Hardened kernel?</td>
<td class="green">Yes, highest</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Hardened libc?</td>
<td class="green">Yes, highest</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Hardened webview?</td>
<td class="green">Yes (Vanadium)</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Hardened SELinux policy?</td>
<td class="green">Yes</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Android Runtime <span class="tooltip">JIT<span class="tooltiptext">Just-In-Time</span></span> compilation/profiling</td>
<td class="green"><span class="tooltip">AOT<span class="tooltiptext">Ahead-Of-Time</span></span> compilation w/o profiling</td>
<td class="red">Interpreter/<span class="tooltip">JIT<span class="tooltiptext">Just-In-Time</span></span> with profiling</td>
<td class="red">Interpreter/<span class="tooltip">JIT<span class="tooltiptext">Just-In-Time</span></span> with profiling</td>
<td class="red">Interpreter/<span class="tooltip">JIT<span class="tooltiptext">Just-In-Time</span></span> with profiling</td>
<td class="red">Interpreter/<span class="tooltip">JIT<span class="tooltiptext">Just-In-Time</span></span> with profiling</td>
<td class="red">Interpreter/<span class="tooltip">JIT<span class="tooltiptext">Just-In-Time</span></span> with profiling</td>
</tr>
<tr>
<td class="legend tooltip">Dynamic code loading prevention for apps<span class="tooltiptext"><a href="https://github.com/eylenburg/eylenburg.github.io/issues/85" target="_blank" style="color: white;">see here for details</a></span></td>
<td class="green">System, opt-in for non-system apps</td>
<td class="red">None</td>
<td class="red">None</td>
<td class="red">None</td>
<td class="red">None</td>
<td class="red">None</td>
</tr>
<tr>
<td class="legend">Additional hardening</td>
<td class="green">Yes, <a href="https://grapheneos.org/features" target="_blank">see here</a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend">Secure TLS for SUPL?</td>
<td class="green">TLSv1.2</td>
<td class="red">TLSv1.1 or TLSv1.0</td>
<td class="red">TLSv1.1 or TLSv1.0</td>
<td class="red">TLSv1.1 or TLSv1.0</td>
<td class="red">TLSv1.1 or TLSv1.0</td>
<td class="red">TLSv1.1 or TLSv1.0</td>
</tr>
<tr>
<td class="legend">Fallback DNS server with DNSSEC?</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="red tooltip">No<span class="tooltiptext">uses Quad9's unsecured endpoint (9.9.9.10) with provides no security blacklist and no DNSSEC</span></td>
<td class="green">Yes</td>
<td class="green">Yes</td>
<td class="green">Yes</td>
</tr>
<tr>
<td class="legend">Secure connection to network time server?</td>
<td class="green">HTTPS via GrapheneOS server</td>
<td class="red">NTP w/o NTS and <span class="tooltip">carrier-based time<span class="tooltiptext">insecure because cellular networks lack proper authentication</span></span></td>
<td class="red">NTP w/o NTS and <span class="tooltip">carrier-based time<span class="tooltiptext">insecure because cellular networks lack proper authentication</span></span></td>
<td class="red">NTP w/o NTS and <span class="tooltip">carrier-based time<span class="tooltiptext">insecure because cellular networks lack proper authentication</span></span></td>
<td class="red">NTP w/o NTS and <span class="tooltip">carrier-based time<span class="tooltiptext">insecure because cellular networks lack proper authentication</span></span></td>
<td class="red">NTP w/o NTS and <span class="tooltip">carrier-based time<span class="tooltiptext">insecure because cellular networks lack proper authentication</span></span></td>
</tr>
<tr>
<td class="legend tooltip">Can disable USB-C and pogo pins data?<span class="tooltiptext">See here for details: <a href="https://github.com/eylenburg/eylenburg.github.io/issues/60" target="_blank" style="color: white;">[1]</a>, <a href="https://github.com/eylenburg/eylenburg.github.io/issues/28" target="_blank" style="color: white;">[2]</a>, <a href="https://github.com/eylenburg/eylenburg.github.io/issues/54" target="_blank" style="color: white;">[3]</a></span></td>
<td class="green">Default (while locked), <a href="https://grapheneos.org/features#usb-c-port-and-pogo-pins-control" target="_blank">see here</a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend tooltip">Can disable USB-C charging?<span class="tooltiptext">See here for details: <a href="https://github.com/eylenburg/eylenburg.github.io/issues/60" target="_blank" style="color: white;">[1]</a>, <a href="https://github.com/eylenburg/eylenburg.github.io/issues/28" target="_blank" style="color: white;">[2]</a>, <a href="https://github.com/eylenburg/eylenburg.github.io/issues/54" target="_blank" style="color: white;">[3]</a></span></td>
<td class="green">Opt-in (after boot), <a href="https://grapheneos.org/features#usb-c-port-and-pogo-pins-control" target="_blank">see here</a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend tooltip">Can disable USB connections?<span class="tooltiptext">See here for details: <a href="https://github.com/eylenburg/eylenburg.github.io/issues/60" target="_blank" style="color: white;">[1]</a>, <a href="https://github.com/eylenburg/eylenburg.github.io/issues/28" target="_blank" style="color: white;">[2]</a>, <a href="https://github.com/eylenburg/eylenburg.github.io/issues/54" target="_blank" style="color: white;">[3]</a></span></td>
<td class="green tooltip">Default (while locked), <a href="https://grapheneos.org/features#usb-c-port-and-pogo-pins-control" target="_blank">see here</a><span class="tooltiptext">Hardware and software</span></td>
<td class="lgreen tooltip">Default (while locked), software only<span class="tooltiptext">Incomplete implementation. Can only disable high level software attack surface. Cannot disable USB until after early boot. Lacks a way to block new USB connections without ending existing connections. The mode for disabling USB connections while locked continues allowing new connections until existing connections end, including a connection through another method such as a pogo pins USB connection to a stand.</span></td>
<td class="lred"><em>? (TBC - like Lineage or stock?)</em></td>
<td class="lred"><em>? (TBC - like Lineage or stock?)</em></td>
<td class="yellow tooltip">Opt-in, software only<span class="tooltiptext">Incomplete implementation. Can only disable high level software attack surface. Cannot disable USB until after early boot. Lacks a way to block new USB connections without ending existing connections. The mode for disabling USB connections while locked continues allowing new connections until existing connections end, including a connection through another method such as a pogo pins USB connection to a stand.</span></td>
<td class="lred tooltip">Device admin API<span class="tooltiptext">Requires installing a device admin app like Sentry. Can only disable high level software attack surface. Cannot disable USB until after early boot. Lacks a way to block new USB connections without ending existing connections.</span></td>
</tr>
<tr>
<td class="legend">Auto-reboot timer for locked devices</td>
<td class="green">Yes</td>
<td class="yellow tooltip">Yes, with flaws (no proper BFU state)<span class="tooltiptext">CalyxOS has a disabled-by-default port of an older GrapheneOS implementation of the auto-reboot feature, which was determined to not be as robust due to being able to bypass it by crashing `system_server`. It also lacks the memory clearing required to get the device properly back at rest for reboots. Therefore it can't return the device to a proper BFU (before first unlock) state like the GrapheneOS and iOS implementations.</span></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend tooltip">2-factor fingerprint unlock</td>
<td class="green">Yes (fingerprint + PIN), <a href="https://discuss.grapheneos.org/d/18585-2-factor-fingerprint-unlock-feature-is-now-fully-implemented" target="_blank">see here</a></td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
<td class="red">No</td>
</tr>
<tr>
<td class="legend semititle"><br />Updates</td>
<td></td><td></td><td></td><td></td><td></td><td></td>
</tr>
<tr>
<td class="legend tooltip">Security update speed (AOSP subset of ASB)<span class="tooltiptext" style="width: 550px; display: inline; white-space: pre-wrap;">It doesn't include information on how the device-related patches in the 2nd half of each ASB (Android Security Bulletin) get shipped, if they do at all. It's also missing the fact that full security patches require the latest monthly/quarterly/yearly updates. Additionally, you need to keep up with the vendor's releases which means falling behind on quarterly or yearly releases results in missing many of the High/Critical severity patches for Pixels or another device launching the new quarterly/yearly version in a reasonable time. The issue is that this heavily varies by device. Pixels require the alternate OS to always keep up to ship updates. Some other device ship yearly updates quickly too. Devices not shipping the latest OS release make it harder for the alternate OS to do it but it is possible, especially if they don't build the vendor image, etc. If the vendor doesn't ship the releases, then the firmware/driver code used from them will be missing the patches. For example, Fairphone is consistently 1 or 2 months behind on the Android Security Bulletin patches so CalyxOS, LineageOS, etc. on it is at least that far behind at all times for the non-AOSP half of the ASB. This is one of the reasons why GrapheneOS currently only supports Google Pixel devices. Every other OEM doesn't ship the monthly/quarterly updates and typically has major delays for yearly updates. Most also do a bad job shipping the backported patches.<br /><a href="https://divestos.org/misc/a-dates.txt" target="_blank" style="color: white;">Click here for update speed data</a></span></td>
<td class="green">Usually same day</td>
<td class="lgreen">Days to weeks</td>
<td class="yellow">2-4 weeks, sometimes longer</td>
<td class="lred">1-2 months, sometimes longer</td>
<td class="lgreen">1-2 weeks, sometimes longer</td>
<td>Depends on phone vendor</td>
</tr>
<tr>
<td class="legend tooltip">Full patches on fully supported devices<span class="tooltiptext">Requires 1. being on the latest OS release (as Android doesn't backport all security patches), 2. shipping all the vendor code</span></td>
<td class="green">Several days</td>
<td class="lgreen">Weeks to months</td>
<td class="yellow">Several to many months</td>
<td class="lred">Many months to over a year</td>
<td class="yellow">Several to many months</td>
<td>Depends on phone vendor</td>
</tr>
<tr>
<td class="legend tooltip">Partial security updates (ASB) after EoL date<span class="tooltiptext">missing most driver and firmware patches after the phone's end of life date</span></td>
<td class="lgreen tooltip">until 5 years from launch<span class="tooltiptext">e.g. 2 years of extended support for 4th and 5th generation Pixels</span></td>
<td class="lgreen">1-3 years</td>
<td class="green">Several years</td>
<td class="green">Several years</td>
<td class="green">Several years</td>
<td class="red">By definition: No</td>
</tr>
<tr>
<td class="legend tooltip">Number of Android versions supported<span class="tooltiptext" style="width: 550px; display: inline; white-space: pre-wrap;">Only the latest major release of AOSP has full security patches. Most privacy fixes are in fact only included for the new OS versions, not in the security patches. The ASB patches patches rarely include fixes for permission model / sandbox flaws resulting in privacy leaks since they're given Moderate severity and often require invasive changes including potential compatibility breaks.</span></td>
<td>Usually 1 Android version</td>
<td>Usually 1 Android version</td>
<td>Usually 1 Android version</td>
<td>2-3 Android versions</td>
<td>Usually 3 Android versions</td>
<td>Usually 3 Android versions</td>
</tr>
<tr>
<td class="legend tooltip">Webview update speed<span class="tooltiptext"><a href="https://divestos.org/misc/ch-dates.txt" target="_blank" style="color: white;">Click here for details</a></span></td>