Mobile OS security comparison (extended) #

Date accessed: 2026-08-30 (America/Belize, UTC−6).
OSes: GrapheneOS, stock Android (Pixel as the high-end reference), CalyxOS, LineageOS, postmarketOS (with Ubuntu Touch as a Linux footnote).
Method: Official docs, forums, and depth-1 clones of focused security repos. Full AOSP / Chromium / kernels were not cloned. Claims below are sourced; community takes are labeled.

1. What each OS is optimizing for #

Stock Android on a generic OEM (Samsung, Xiaomi, …) is usually weaker than Pixel stock: slower vendor/GPU patches, extra privileged preloads, and often no user-settable AVB key. Samsung One UI 8 bootloader-unlock removal was widely reported in Jul 2025 (Samsung did not confirm to The Verge at publication). Xiaomi unlock is account/quota gated; many CN SKUs cannot unlock.

2. Feature table (detailed) #

Legend: Yes = product default or official requirement. Partial = exists but limited, opt-in, device-class specific, or unfinished. No = not present or deliberately disabled. AOSP = inherited Android baseline, not an extra.

Boot integrity #

Sources: GrapheneOS features, install/web, AOSP device-state, CalyxOS bootloader-lock, LineageOS charter SHA 33d1853d…, LineageOS FAQ, pmbootstrap flash_vbmeta.

Memory safety / exploit mitigations #

Code check (GrapheneOS hardened_malloc 714abf5a…): canary mask forces a leading zero; fatal_error("canary corrupted"|"double free"|"detected write after free"); zero-on-free; MTE reserved tag 0; canaries skipped when MTE is on. Android.bp uses the aggressive preset (N_ARENA=1), not light.mk. platform_bionic b95b0888…: LP64 Malloc → h_*; compile error without USE_H_MALLOC; unprivileged apps can flip /proc/self/attr/grapheneos_flags bit 1<<10 to Scudo.

Stock Chrome on Pixel has memtagMode=async per AOSP MTE docs (partial catch-up). Vanadium still disables JS JIT by default and sets is_cfi = true (args.gn 150a27e2…).

Sandbox, Google, network #

GrapheneOS will never ship Play or microG as a privileged implementation (homepage). CalyxOS FAQ says restricted spoofing is “not a security risk”; GrapheneOS, Privacy Guides (dropped CalyxOS 2022), and discuss.grapheneos.org disagree. Overlap that is not partisan: CalyxOS does ship privileged microG, does spoof a hardcoded signature, does talk to mtalk.google.com when push is on.

Encryption, lockscreen, local ports #

Ubuntu Touch (footnote): fscrypt of /home-class trees, rootfs unencrypted; experimental in 24.04-1.0. AppArmor click confinement. Privileged Halium Android LXC. Not GrapheneOS-class AVB.

Browser, updates, hardware #

3. Code-review notes (what was actually cloned) #

Unmodified --depth 1 clones. No full platform trees.

GrapheneOS #

Not verified: kernel MTE/CFI/lockdown, full Chromium, device sepolicy trees.

CalyxOS / LineageOS #

Trail of Bits (Jan 2026) on CalyxOS HSM ceremony: 1 medium (rogue admin keys), 2 informational. ToB library.

postmarketOS #

flash_vbmeta comment: Generate vbmeta image with “disable verification” flag. Duranium blog (2026-03-17): “Secure Boot and verified boot are not yet implemented, but are planned.” Wiki.postmarketos.org was Anubis-blocked during this pass; facts taken from git + official blog.

Stock Android source #

AOSP gitiles ?format=TEXT returned HTTP 400 for Scudo README. AVB README was read from a LineageOS GitHub mirror of android_external_avb (not a live AOSP HEAD SHA). Bionic MTE notes from aosp-mirror docs/mte.md. Android Security Papers 2024/2026 PDFs are listed on Google’s reports page; guessed download URLs 404. Year in Review archive on that page still ends at 2018.

4. Limitations and criticisms (labeled) #

GrapheneOS (project-acknowledged): Pixel-only until Motorola 2027; firmware/drivers still Google’s; Pixel 11 skipped for missing MTE; Play Integrity DEVICE/STRONG will not pass (no spoofing); VPN leak blocking “not complete”; Seedvault to be replaced; no FRP; exec-spawn ~200 ms extra cold start; carrier SKUs often cannot unlock. Duress-PIN legal incident reported by Ars Technica, Aug 2026 — not GrapheneOS docs. Hardware attestation still chains to Google roots (Titan/SoC not GrapheneOS-controlled).

Pixel stock: Privileged GMS is a large TCB and patch channel at once. GPU/vendor drivers remain the main 2023–2026 local-privesc path even on patched Pixels (Project Zero Mali/KGSL work; independent Mali dirty-pagetable on stock Pixel 7 Pro, CVE-2025-8045). GrapheneOS on the same Pixel shares that GPU IOCTL surface; hardening raises the cost of userspace memory corruption, it does not delete /dev/mali0.

CalyxOS: Confirmed ~11-month security freeze after Merrill/Desai left (letter 2025-08-01). Shipping again 2026-07-01. Privacy Guides dropped CalyxOS in 2022 (privileged microG fails their “no system modification for Play” rule) and still lists only GrapheneOS. Kuketz 2023 traffic capture is dated; do not treat SUPL-IMSI as current. Relock is not uniform across device classes.

LineageOS: Charter + FAQ confirm unlocked BL, userdebug, system verity off — below stock on physical tamper / persistent malware. Kuketz 2023 titled it “neither secure nor privacy-friendly”; 2026 Updater/ASB tooling improved, VB policy did not. Vendor SPL = whatever blobs the maintainer extracted.

postmarketOS / Ubuntu Touch: Honest gap vs Android: no hardware RoT for the whole OS, no Weaver, no mandatory app sandbox, no monthly firmware ASB. Duranium is the project’s own attempt to close dm-verity//usr; they say Secure Boot is unfinished. Waydroid/Halium add a privileged Android userspace. Good for e-waste and mainline kernels; not a GrapheneOS substitute for AFU forensic resistance. Project disclaimer (v25.06): not Android/iOS polish.

iodéOS /e/OS (not table columns): LineageOS + microG + extra firewall/cloud. Same VB/userdebug caveats as LOS, plus privileged microG. LineageOS for microG is a separate fork (Dec 2025 key leak; APEX test-keys still documented as open).

5. Practical reading #

1. Highest exploit resistance on a phone you can buy today: GrapheneOS on Pixel 8–10a (MTE + 7-year OEM window). Relocked AVB, Auditor, hardened_malloc, default MTE, sandboxed Play. Cost: Pixel lock-in, Play Integrity, banking apps, Google firmware TCB.
2. Highest “normal Android” security with app compatibility: Pixel stock. Same hardware RoT and bulletins, privileged GMS, MTE not default-on, no Network/Sensors toggles.
3. De-Google with relocked VB on more than just Pixels: CalyxOS, with the 2025–26 freeze and microG privilege as the two load-bearing caveats. Treat as privacy-UX on AOSP, not a hardening OS.
4. Old or odd hardware, know the bootloader stays open: LineageOS. Do not call it more secure than stock on the same device.
5. Linux on a phone: postmarketOS (or UT). Different OS class. Do not expect Android verified boot, TEE throttling, or a malicious-app sandbox.

6. Source list #

All accessed 2026-08-30 unless a page carries its own date. Fuller per-OS bibliographies are in the four findings.md files.

Official docs #

1. https://grapheneos.org/features
2. https://grapheneos.org/faq
3. https://grapheneos.org/usage
4. https://grapheneos.org/releases
5. https://grapheneos.org/install/web
6. https://grapheneos.org/articles/attestation-compatibility-guide
7. https://attestation.app/about
8. https://source.android.com/docs/security/features/verifiedboot
9. https://source.android.com/docs/security/features/verifiedboot/avb
10. https://source.android.com/docs/security/features/verifiedboot/device-state
11. https://source.android.com/docs/security/test/scudo
12. https://source.android.com/docs/security/test/memory-safety/mte-configuration (updated 2026-06-17)
13. https://source.android.com/docs/security/test/cfi
14. https://source.android.com/docs/security/bulletin/pixel
15. https://developer.android.com/google/play/integrity/overview
16. https://calyxos.org/features/list/
17. https://calyxos.org/docs/guide/security/bootloader-lock/
18. https://calyxos.org/docs/tech/microg-details/
19. https://calyxos.org/news/2026/07/01/calyxos-official-release-is-back/
20. https://calyxos.org/news/2026/08/28/august-feature-update/
21. https://calyxos.org/news/2025/08/01/a-letter-to-our-community/
22. https://wiki.lineageos.org/faq
23. https://github.com/LineageOS/charter
24. https://lineageos.org/Changelog-30/
25. https://lineageos.org/Infrastructure-Apps-Updates/
26. https://postmarketos.org/blog/2025/06/22/v25.06-release/
27. https://postmarketos.org/blog/2026/03/17/introducing-duranium/
28. https://docs.ubports.com/en/latest/appdev/platform/apparmor.html
29. https://docs.ubports.com/en/latest/porting/configure_test_fix/Fscrypt.html

Code (cloned) #

30. hardened_malloc 714abf5a… — https://github.com/GrapheneOS/hardened_malloc
31. platform_bionic b95b0888… — https://github.com/GrapheneOS/platform_bionic
32. Auditor f1bb2ac9… — https://github.com/GrapheneOS/Auditor
33. Vanadium 150a27e2… — https://github.com/GrapheneOS/Vanadium
34. vendor_calyx 9fbd5656… — CalyxOS GitLab
35. LineageOS charter 33d1853d…
36. pmaports 99ef80cb… — https://gitlab.postmarketos.org/postmarketOS/pmaports.git
37. pmbootstrap defc7746…

Forums / research / press (used where labeled) #

38. https://discuss.grapheneos.org/d/23977-workaround-for-play-integrity-on-grapheneos-possible
39. https://discuss.grapheneos.org/d/32656-motorola-partnership-announcement
40. https://grapheneos.social/@GrapheneOS/117179621198542373 (Pixel 11 / MTE, 2026-08-29)
41. https://www.privacyguides.org/en/android/distributions/
42. https://www.privacyguides.org/articles/2022/04/21/grapheneos-or-calyxos/ (dated 2022)
43. https://www.kuketz-blog.de/calyxos-de-googled-geht-anders-custom-roms-teil2/
44. https://www.kuketz-blog.de/lineageos-weder-sicher-noch-datenschutzfreundlich-custom-roms-teil4/
45. https://projectzero.google/2023/11/first-handset-with-mte-on-the-market.html
46. https://projectzero.google/2022/11/mind-the-gap.html
47. https://kuzey.rs/posts/MaliDF/ (CVE-2025-8045 on stock Pixel 7 Pro)
48. https://9to5google.com/2026/03/01/motorola-confirms-grapheneos-partnership-for-a-future-smartphone-porting-features/
49. https://arstechnica.com/gadgets/2026/08/motorolas-grapheneos-phones-will-launch-in-2027-priced-higher-than-pixels/
50. https://www.theverge.com/news/714902/samsung-one-ui-8-bootloader-unlocking-android-roms
51. https://trailofbits.com/library/calyx-institute-hsm-provisioning-ceremony-scripts/

Method caveats #

• Discord (GrapheneOS) was not scraped; contact page says it is the active chat and is not bridged to Matrix.
• postmarketOS wiki HTML was Anubis-blocked.
• “GrapheneOS patches faster than Pixel” is not treated as a 2026 measured fact (features-page example is 2023-11-06).
• Kernel and full Chromium trees were not reviewed.