Smear Campaign Towards GrapheneOS

https://news.ycombinator.com/item?id=50173902

https://news.ycombinator.com/item?id=49355370

https://news.ycombinator.com/item?id=49363163

https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

The founder of Murena strongly implies that the difference between /e/ and GrapheneOS is that GrapheneOS is designed to protect pedos, for example. I think that explains a lot.

https://www.clubic.com/actualite-604786-murena-e-os-intervie...

https://docs.qualcomm.com/securitybulletin/october-2026-bull...

Then, they only roll out ASBs, which fixes vulnerabilities that have been known for up for six months, because they don't roll out embargoed patches like e.g. GrapheneOS does (and these vulnerabilities have been known for months through reverse engineering).

If that wasn't bad enough, ASBs only fix vulnerabilities high/critical, for all other fixes you need QPRs and major releases, but /e/OS is behind major releases. If you are still running Android 16, your phone has vulnerabilities that are known for up to two years. Yes, they are low/medium, but they are used in exploit chains. This recently got worse, because Google recently started only rolling out some high/critical fixes to Android 17 and not older Android versions.

Then there is all the shady stuff that Murena doesn't tell you about, like running Google's proprietary DroidGuard blobs in a privileged process on Play Integrity requests. Giving certain Google apps higher privileges than the normal Android app sandbox. Installing F-Droid packages through a proxy (CleanAPK), that they do not want to reveal the owner or purpose of, etc.

Why don't the GrapheneOS developers like Murena? Because Murena often instigates in interviews that GrapheneOS is for criminals, etc.

If you care about security (or privacy) at all, don't use /e/OS.

Disclaimer: I am not affiliated with the GrapheneOS project in any way. If you don't like GrapheneOS but care about having some basic security, then get an iPhone.

Also GrapheneOS can't be compared to other privacy/de-googled roms because none other are as deeply tied to the security/isolation/memory protection features shipping on pre-11 Pixels and 2027+ Motorola flagships.

I think the whole thread misses the mark a bit, because the source that the GrapheneOS account used (Algemeen Dagblad) did not properly research this. For Dutch readers, this is not really surprising, since the AD is not known as a quality newspaper and tends to go for sensationalism (though slightly less bad than De Telegraaf). Other sources are much more detailed:

According to our information, the reseller did not distribute official GrapheneOS. Using AI tools, he had built his own fork and added mobile device management (MDM) for remote administration. The result was a separate operating system that lacked, among other things, the security updates of the original project.

His signing keys for that system were probably compromised. Anyone holding those keys can build an update that the phones accept as genuine. Such an update was apparently installed on seized phones via ADB (Android Debug Bridge), an interface that requires a USB cable connection, and probably removed the screen lock. The phones could then be examined forensically. On our information, the authorities again needed the phone in their hands. On official GrapheneOS, the same approach would require the project's own signing keys.

https://www.joint-defense-team.com/post/grapheneos-cracked-p...

AD could have written something similar if they did their homework in understanding the case.

tl;dr mostly shoddy journalism from AD.

We live in 2026 where every open source project is being scrutinized endlessly by thousands of agents to try to find vulnerabilities anywhere and everywhere, and you can do it yourself with just a prompt and a spare laptop and phone.