Samsung and Google ship security preview patches too, but with a significant delay (at least around 4 weeks) and it's far from all of the preview patches. You can look at past Samsung security bulletins and you'll see there are CVEs listed from future Android Security Bulletins.

We have a partnership with Motorola largely because Pixels are becoming a mess. The initial Motorola device with official GrapheneOS support will be a high end device coming out in the near future. It will take more time before lower end devices even one step down from there meet our requirements.

Pixel 6 and Pixel 6 Pro are now past their guaranteed 5 years of updates. However, that doesn't imply they're going to be immediately cut off from all updates from Google. It's fairly likely they will be cut off starting this month but sometimes they release another update or two past end-of-life.

GrapheneOS updates to those new major versions of Android within days of release. We should be able to get better at doing it soon. There are definitely problems with the overall system but this part is nearly entirely an issue for people not using either GrapheneOS or the stock Pixel OS.

Google wants Android users to feel safe due to believing they have the latest privacy and security patches. Therefore, they delay patches being listed in the bulletins for months and don't list a substantial portion of Linux, driver and firmware patches. It's a very low bar so devices can keep up.

Each Android Security Bulletin also has a 2nd section with listing an extraordinarily small subset of the vulnerabilities patched in the upstream Linux kernel along with a small subset of vulnerabilities patched in drivers/firmware shared by many devices. This is deliberate to keep the bar very low.

Their announcement explains the massive number of vulnerabilities discovered by AI models internally will only be patched in the latest major releases. A subset deemed to pose an imminent risk to users will be backported to the most recent releases but not to older releases with security support.

In 2026, Google has been completely overwhelmed by the volume of vulnerabilities being discovered by AI models both internally and externally. They recently announced to OEMs that the full set of High and Critical severity patches will only be available through the latest yearly and QPR2 releases.

GrapheneOS provides security preview releases providing early access to all of the security preview patches. It's the only OS quickly shipping all of these patches. A subset of these patches are shipped early by the stock OS on Pixels and Samsung flagships but far from all and it comes weeks later.

The security preview patches aren't only for Android projects but rather also include patches to external projects. Some of these external patches are already publicly disclosed while others are not. As one example, there have been non-publicly-disclosed security preview patches for wpa_supplicant.

The first section is the main portion of the patches and gets provided 2-6 months in advance as security preview patches. The security preview patches are allowed to be shipped right away, which is sensible. The horrific part is delaying disclosure of the vulnerabilities and patches for months.

Android Security Bulletins are divided into two sections. The first section contains High and Critical severity Android Open Source Project (AOSP) patches backported to older releases. For years already, Low and Moderate severity AOSP patches have required updating to the latest major releases.

Android Security Bulletins have been twisted into a way to mislead the public about security. Patches are only listed in the bulletins 2-6 months after they're disclosed to each Android OEM and allowed to be shipped. Patches listed in the September 2026 bulletin were available to ship for months.

We've already provided more information on our feed. We're not going to make announcements in replies.