The privacy-hardened Android distribution GrapheneOS has finished the journey its developers flagged in mid-July: the project’s Android 17 build now sits on the Stable channel. The 2026071500 release is tagged for every currently supported device, from the Pixel 6 all the way to the Pixel 10a, alongside the Pixel Fold, Pixel Tablet, emulator, and generic build targets releases page. For anyone running a Pixel as a daily driver, that promotion is the moment an experimental port becomes the version the project actually recommends installing.
GrapheneOS ships releases through a deliberate three-stage funnel — Alpha first, then Beta, then Stable — so that regressions surface in front of testers before they reach cautious users. The project spells out that a build lands on Stable “after being tested by users using the Beta channel,” and that downgrades are effectively blocked unless a specially signed downgrade package exists releases page. Reaching Stable, in other words, is not a version bump; it is the signal that the Android 17 base has cleared that gauntlet.
The changelog for 2026071500, measured against the prior 2026071100 build, is dominated by app-compatibility plumbing rather than flashy features — which is exactly what you want from a build being blessed as stable. Several entries harden the OS’s “secure (exec) spawning” model so it plays nicely with anti-tampering software: GrapheneOS now skips a V-KEY V-OS preload step and drops redundant mount-namespace setup so apps that inspect Linux mount IDs stop breaking, and it starts the compatibility zygote at boot rather than on demand for the same reason releases page. To keep that change from taxing memory, the compat zygote uses lazy preloading and is only spun up for app processes that disable both hardened_malloc and secure spawning.
Other fixes target the multi-user experience that Android 17 reworked. GrapheneOS now installs CarrierConfig2 across all profiles so secondary users stop inheriting default carrier settings, and it adds a notification when a Wi-Fi hotspot is switched off because each user carries separate Wi-Fi settings since Android 17 releases page. Under the hood the release moves the 6.6 kernel branch to GKI LTS revision 6.6.141 and updates the project’s hardened Vanadium browser to Chromium base 150.0.7871.124.0.
The more consequential story sits in the companion 2026071501 security preview. Security preview builds are where GrapheneOS front-loads patches ahead of the monthly cadence, and this one is unusually broad: it folds in Android 17 security fixes drawn from the July 2026, August 2026, September 2026, October 2026, November 2026, December 2026, and January 2027 Android Security Bulletins releases page. Google publishes those bulletins on a rolling schedule, and GrapheneOS routinely pulls the fixes forward for users who opt into preview channels Android Security Bulletins. The listed catch-up includes roughly two dozen CVEs rated Critical — among them CVE-2026-28591, CVE-2026-45515, and CVE-2026-49918 — plus a much longer roster of High-severity issues spanning framework, kernel, and driver components.
That split between a conservative Stable build and an aggressive security preview is the practical shape of GrapheneOS’s threat model. Users who prioritise stability run 2026071500; those who want the earliest possible patch level accept the preview’s rougher edges. Both benefit from the project’s layered defences — verified boot, the hardware-backed keystore, and internal signature checks on every update payload that also block downgrade attacks releases page.
One migration note carries over from the port work: users upgrading a device from a pre-Android-17 GrapheneOS build are expected to use the standard over-the-air update system rather than ADB sideload, and the team prepared a special Android 16 QPR2 build with a backported fix so sideload-only users are not stranded during the transition releases page. With Stable now live across the lineup, the Android 17 chapter that opened as an alpha earlier this month is, for most Pixel owners, ready to install.
