Below is version information for branches and devices for you to judge your device's security upon.
A note on operating system security¶
There is a singular all-or-nothing, all-encompassing Android security bulletin released every month that covers security issues across the entire system.
Below we break it into five parts solely for ease of understanding for you to determine the general security of a given operating system.
Being behind on any one part means the system is inherently insecure.
- the version of Android itself, newer versions have more security features/hardening
- the ASB patch level, these are essential security patches
- the Pixel ASB patch level, these are recommended security patches and are only provided for the latest Android version
- the vendor ASB patch level, see Qualcomm
- and lastly the Linux kernel version
- GrapheneOS, with the exception of the Pixel 3/4 series, strictly only supports devices that have all parts updated.
- CalyxOS, with the exception of the Pixel 3/4 series and other non-Pixel devices, in theory only supports devices that have all parts updated.
- LineageOS can help with 1, 2, 3, and usually 5, but if a device is out of support by its manufacturer it cannot help with 4.
- DivestOS, being Lineage based helps with 1, 2, 3, can minimize 4 via the deblobber, and improve 5 significantly using the CVE auto-patcher.
- Any of the above operating systems will be an improvement for any device that is no longer receiving support from its manufacturer if they continue to offer monthly updates with at least some parts covered.
Such hardening changes can prevent exploitation of both known and unknown issues and are not found in LineageOS, CalyxOS, or most other aftermarket systems.
If you are choosing an operating system for security the order is GrapheneOS, then DivestOS, then official LineageOS, with the choice depending on what device you have or can acquire/afford.
At the potential cost of freedom and/or privacy, you may even want to consider the stock OS as long as it is not end-of-life.
What about this other OS?¶
- CalyxOS occasionally falls behind updates (see 1 and 2), has no added hardening features, and primarily only supports Pixels which are better supported by GrapheneOS.
- /e/OS has many severe issues as documented here.
- UBports, based on Ubuntu 16.04, lacks encryption support, retains many of the Android components via Halium, and uses unpatched & end of life kernels in many of its featured devices.
- Replicant 6.0, based on LineageOS-13.0, hasn't received any security patches in years and the devices run near decade old Linux 3.0 kernels.
- GSIs should be avoided, they do not provide the kernel or vendor components and cannot utilize many security features.
- Lastly many aftermarket systems often do not provide consistent and timely updates to the system WebView component as documented here. This is a security critical component of the system not included in the ASB that is frequently overlooked and/or ignored.
Does DivestOS make my device secure?¶
The short answer: No.
The long answer is that DivestOS is likely the best harm reduction option if your device is no longer in support by its manufacturer or vendor.
Any project or product claiming they make end-of-life devices secure should be rigorously scrutinized.
If you want a reasonably secure and well-maintained device, please acquire a newer Pixel (6/6a/7) that is fully supported by GrapheneOS and use it instead.
Lastly it must be noted that privacy and security go hand-in-hand, there is a fundamental limit of how much privacy you can achieve if you do not have security backing it up.
Last updated: 2023-02-05
Asterisk* denotes known missing patches
DivestOS inherently cannot and does not include all patches from the monthly Android Security Bulletin.
The patch level shown in the Settings app on DivestOS should not be regarded as accurate, in favor of this page. It merely conveys the most recent month that it may contain patches from.
Also of note, DivestOS typically takes eight months to stabilize after a new Android version is released.
A historical comparison of operating system patch levels is available here, along with patch counts documented here.
|Version||End of Life||Android Security Bulletin||Pixel Security Bulletin|
|20.0 / 13.0 / T ★||Late ~2026?||LOS: 2023-01, DOS: 2023-01||2023-01|
|19.1 / 12.1 / S||Mid ~2025||LOS: 2023-01, DOS: 2023-01||2022-07, 217 days ago|
|18.1 / 11.0 / R||Late ~2023||LOS: 2023-01, DOS: 2023-01||2021-10, 490 days ago|
|17.1 / 10.0 / Q||Late ~2022, EOL soon!||LOS: 2023-01, DOS: 2023-01||2020-08, 916 days ago|
|16.0 / 9.0 / P||2022-01, 402 days ago||LOS: 2022-01, DOS: 2023-01*||2019-08, 1282 days ago|
|15.1 / 8.1.0 / O||2021-10, 490 days ago||LOS: 2021-10, DOS: 2023-01*||2018-12, 1525 days ago|
|14.1 / 7.1.2 / N||2019-10, 1221 days ago||LOS: 2021-06, DOS: 2023-01*||2017-12, 1890 days ago|
Linux Version Status¶
Last updated: 2023-02-05
|Version||Last||End of Life|
|4.9||4.9.337||2023-01-07, 31 days ago|
|4.4||4.4.302||2022-02-03 + 2027-01 (CIP), 369 days ago|
|3.18||3.18.140||2019-05-16 + 2021-10 (Google/Linaro), 490 days ago|
|3.10||3.10.108||2017-11-04, 1921 days ago|
|3.4||3.4.113||2016-10-26, 2295 days ago|
|3.0||3.0.101||2013-10-22, 3395 days ago|
Last updated: 2023-01-23
Of note, DivestOS only includes firmware on select devices as documented here.
Devices listed below denoted with a '★' can be considered reasonably secure if firmware is included and the device is relocked.