A note on ROM security¶

There are five parts that you can use to determine the general security of a ROM:

1. the version of Android itself, newer versions have more security features/hardening
2. the ASB patch level, these are essential security patches
3. the Pixel ASB patch level, these are recommended security patches
4. the vendor ASB patch level, see Qualcomm
5. and lastly the Linux kernel version

• GrapheneOS strictly only supports devices that have all parts updated.
• CalyxOS, with the exception of the Pixel 2 and Mi A2, only supports devices that have all parts updated.
• LineageOS can help with 1, 2, 3, and usually 5, but if a device is out of support by its manufacturer it cannot help with 4.
• DivestOS, being Lineage based helps with 1, 2, 3, can minimize 4 via the deblobber, and improve 5 significantly using the CVE auto-patcher.
• LineageOS (and derivatives) notably only apply Pixel ASB's to the most recent branch.
• Any of the above ROMs will be a dramatic improvement for any device that is no longer receiving support from its manufacturer.
• Replicant 6.0 is based on the LineageOS-13.0 branch and is behind on all parts.

Branches¶

Last updated: 2022-01-12
Asterisk* denotes known or likely missing patches

Linux Version Status¶

Last updated: 2022-01-07

Devices¶

Last updated: 2022-01-07