GrapheneOS 2026111300 patches 117 CVEs, updates kernels, removes eMudhra root CA

GrapheneOS has published version 2026111300 for Pixel 10 series devices, bundling Android 17 security patches from December 2026 through May 2027 and addressing 117 CVEs rated critical and high severity. The release updates both the 6.1 and 6.18 GKI LTS kernels, fixes multiple Pixel 10-specific kernel issues including power management and memory leaks, and removes the eMudhra root certificate before Chrome, Firefox, Edge, and Safari block or remove it. The update also restores SHA-1 support for IMS carrier tunnels, fixes WebView crashes caused by an upstream Android bug, and refreshes the Vanadium browser and GmsCompatConfig components.

This release is notable for its proactive certificate handling and the breadth of its security preview, which includes patches from future Android bulletins not yet available in stock Pixel OS. The kernel fixes target specific subsystems including pKVM SMMU, CoreSight tracing for DSP/TPU/GDMC, and USB PD charge-pump selection, reflecting GrapheneOS's continued focus on hardening the underlying platform rather than just applying surface-level patches.

Kernel, security, and certificate changes in 2026111300

• Kernel updates: Both GKI LTS branches are refreshed, with 6.1 moving to 6.1.182 and 6.18 to 6.18.39, plus a backported fix for missing udmabuf cache synchronization in 6.18.
• SHA-1 restoration: The 6.18 kernel re-enables explicit SHA-1 cryptographic algorithm usage, fixing an unintentional regression from the 6.6-to-6.18 port that broke IMS tunnels with carriers using legacy ciphers.
• Pixel 10-specific kernel fixes: Four targeted patches address USB PD wakelock polling during charge-pump selection, GNSS crash dump registration failure handling, pKVM SMMU memory leaks on early initialization failure, and broken CoreSight debug tracing for DSP, TPU, and GDMC subsystems.
• Certificate authority cleanup: The eMudhra root certificate is removed preemptively, along with 26 obsolete CA roots already dropped from Pixel OS but lingering in AOSP, ahead of enforcement dates by major browser and OS vendors.
• CVE coverage: The security preview release patches 13 critical CVEs and 104 high-severity CVEs spanning the December 2026 through May 2027 Android Security Bulletins.

Why it matters

For users of hardened mobile Linux alternatives, this release demonstrates how a privacy-focused Android fork can outpace upstream vendors in security delivery by bundling half a year of bulletins before they reach stock devices. The proactive certificate removal reduces trust store attack surface ahead of industry-wide enforcement, while the kernel-level fixes for pKVM and CoreSight tracing preserve functionality critical for developers and security researchers working with isolated execution environments and hardware debugging on Pixel 10 hardware.