Bilingual

CalyxOS is back
23 days ago
- CalyxOS resumed releases after a hiatus since August 2025.
- The new version 7.2.2.0 introduces an HSM-based open-source signing solution for enhanced security.
- Infrastructure improvements include a cleaner server structure and scripts to manage AOSP updates.
- Manual steps are still required to handle AOSP changes and kernel source storage.
- Maintenance continues on device trees for LineageOS and CalyxOS due to missing Google Pixel trees.
Elevating Privileges from Firefox to Android Root
22 days ago
- First browser-to-kernel full-chain RCE on Android 17 announced.
- Source code for the exploit will be made publicly available.
- Supported kernels result in root access and wallpaper change as success signal.
- Unsupported kernels cause phone crash and reboot without permanent damage.
- Users can modify the exploit to support their own devices.
New Android security setting spots bad networks and fake cell towers
21 days ago
- ZDNET's recommendations are based on testing, research, and independent sources, with no influence from advertisers.
- Android 17's 'Network notifications' feature alerts users when connecting to unencrypted networks or those recording device/SIM IDs to prevent data breaches.
- Enabling this feature involves turning on a slider in Settings under 'Network & internet' > 'Mobile network security'.
- The feature also includes 'Network generation' to block connections to insecure 2G networks vulnerable to spoofing attacks.
Android is almost dead – OSnews
20 days ago
- Google's Android Developer Verifier (ADV) process acts as a virus installed on Android 8+ devices, awaiting remote activation.
- ADV runs as a system service with root privileges, cannot be blocked or removed, and is spread via Play Protect.
- Once activated, ADV blocks software from developers not approved by Google, threatening F-Droid and open-source repositories.
- Concerns include the end of openness on Android, increased pressure from the Google-Apple duopoly, and loss of user control.
- Potential responses include EU regulation, but skepticism exists due to global acceptance of Apple's restrictions.
- Discussion of new mobile OSes, but hardware lockdowns (like fused roots) and government approvals hinder alternatives.
- MicroG is a FOSS replacement for Google Play Services, but third-party apps often require Google services, limiting its use.
- Debate ties into broader issues: digital IDs, government surveillance, and corporate control over computing freedoms.
- Comparisons note Windows and x86 PCs as currently more open than Android or macOS in running unsigned executables.
- Strategies to avoid Google reliance include skipping login, disabling Google apps, using F-Droid, and avoiding bank apps on Android.
Ongoing changes to Android security patches due to AI vulnerability discovery
12 days ago
- Google is reducing backport support for older Android versions, limiting critical vulnerability patches to the most recent 2 major releases (Android 16 and 17).
- Externally reported high and critical vulnerabilities are still backported for about 3 years, but internal discoveries by Google (often via AI) have stricter limits.
- Android Security Bulletins now omit moderate and low severity patches and are delayed by 2-4 months after disclosure; only Samsung flagships, Pixels, and GrapheneOS ship patches early.
- Bare minimum security patches now require being on Android 16, 16 QPR2, or 17, with Android 18 becoming the sole source for current high/critical patches upon release.
- GrapheneOS plans to work with Motorola and Qualcomm for serious patches, port to the latest Linux LTS, and may reverse-engineer binary patches if Google doesn't open-source security previews.

Hasty Briefsbeta

android security

CalyxOS is back

Elevating Privileges from Firefox to Android Root

New Android security setting spots bad networks and fake cell towers

Android is almost dead – OSnews

Ongoing changes to Android security patches due to AI vulnerability discovery