GrapheneOS 2026110700 patches 96 CVEs, adds coarsened location APIs and overhauls emergency number handling

GrapheneOS has released version 2026110700, a major security update for its hardened Android distribution that rolls in all Android 17 security patches from December 2026 through May 2027 ahead of Google's official schedule. The release addresses 12 critical and 84 high-severity CVEs, including memory corruption and privilege escalation flaws in the Android ecosystem. Beyond security backports, the update introduces dedicated APIs for requesting coarsened locations, replacing an internal reimplementation in the sandboxed Google Play compatibility layer and enabling Vanadium to request deliberately imprecise location data.

The release also overhauls emergency number handling by building new extraction infrastructure in adevtool and arsclib to pull proper data from Safety Hub, discarding the outdated and broken AOSP implementation. Kernel-level fixes target the 6.1 and 6.18 branches, including a slab canary activation fix for bulk allocation failures and multiple Pixel 10-specific audio and PCIe synchronization corrections. Vanadium, the project's Chromium fork, advances to version 157.0.8103.38.0, and the launcher gains extended search filtering for locked or paused work profiles.

Kernel hardening and privacy architecture changes

• Coarsened location APIs: New system APIs replace GmsCompat's internal LocationFudger reimplementation, allowing Vanadium and the sandboxed Google Play compatibility layer to request deliberately degraded location precision through a unified interface.
• Emergency number infrastructure: The project replaced AOSP's broken emergency number database with tooling in adevtool and arsclib that extracts current data directly from Google's Safety Hub, closing a long-standing reliability gap in critical call routing.
• Kernel 6.1 slab canary fix: Bulk allocation failure paths now activate slab canaries before freeing memory, preventing BUG-triggered panics on non-MTE devices; this condition was absent from 6.12 and 6.18 branches and statistically rare.
• Kernel 6.18 FUSE and Pixel 10 audio fixes: The update backports an upstream FUSE use-after-free patch and resolves audio offload compatibility, compressed audio timestamp counter wraps, zram initialization failures, and missing PCIe rescan synchronization specifically for Pixel 10 devices.
• Microdroid kernel signing: Forced module signing is enabled for microdroid's 6.12 and 6.18 kernels, with SHA-1 replaced by SHA-256 for module signature hashing, aligning with upstream Android's security posture.

Why it matters

GrapheneOS's practice of bundling future Android security patches months ahead of Google's release schedule provides a concrete model for how downstream hardened distributions can outpace vendor update cycles, particularly relevant as mobile Linux alternatives like postmarketOS and Droidian grapple with similar lag. The coarsened location API work demonstrates how privacy-focused projects can reshape Android's permission architecture without breaking compatibility with sandboxed proprietary services, an approach that may inform other de-Googled distributions seeking to balance functionality against surveillance capitalism.