Android 17 QPR1 reached the Pixel 11 Pro on 15 September, and GrapheneOS says Google held part of it back. The project claims the quarterly update’s new developer APIs never reached open source, and that fixes for standard Android code will not arrive on a Galaxy S26 Ultra until December 2026.
GrapheneOS set out its concerns across a series of posts on Mastodon on 16 September. The project has spent years building a hardened version of Android on Pixel hardware, so it tends to notice this kind of change before others do.
Android 17 QPR1 is described as the first release since Honeycomb to add new developer APIs without pushing them to the Android Open Source Project, leaving them exclusive to the Pixel operating system.
Why non-Pixel phones wait until December
Google’s September Pixel Update Bulletin lists the components involved, and the range is notable. Settings, System UI, Bluetooth, NFC, Android Verified Boot and KeyMint all appear, and none of those relate to Pixel hardware.
The December timing has a straightforward explanation. Google changed how it publishes Android source this year, moving from continuous releases to two drops, in Q2 and Q4, to keep the platform stable for everyone building on it. QPR1 arrived in Q3, which sits between those two windows, so there was no source drop to attach it to. QPR2 lands in December, which falls in Q4.
For those holding a Galaxy or Motorola handset, the practical impact is limited. Samsung ships its own monthly security updates and decides when platform fixes land in One UI, so the date that has always mattered to a Galaxy owner is Samsung’s rather than Google’s.
GrapheneOS says its forthcoming Motorola partnership will hand it firmware and driver code directly, an unusual requirement from a third party given that Google produces Android.
What a December wait means for security patches
Pixel owners already have the 15 September patch level, and installing it completes the process.
On any other device, fixes for Settings, System UI, Bluetooth and NFC are not yet in the queue. Google’s stated position is that these particular components are not required for declaring a security patch level.
GrapheneOS also questioned whether Google’s legal team is aware that Pixels are receiving months of early access to fixes and features, describing that advantage over Google’s partners as very dubious. The project has said it can ship the patches early by reverse engineering the code, with other manufacturers otherwise receiving them in December 2026 via Android 17 QPR2.
Source
Image: phonearena.com
