Android 17 QPR1 has a change GrapheneOS thinks Google's lawyers should know about

Android 17 QPR1 reached the Pixel 11 Pro on September 15, and GrapheneOS says Google kept part of it back. The project claims the quarterly update's new developer APIs never went to open source, and that fixes for standard Android code will not reach a Galaxy S26 Ultra until December.

GrapheneOS says the newest Android 17 code stopped at Pixel

GrapheneOS laid this out in a series of posts on Mastodon on September 16. The project has spent years building a hardened version of Android on Pixel hardware, so it tends to spot this sort of change before anyone else does.

Android 17 QPR1 is the first release since Honeycomb to add new developer APIs without pushing them to the Android Open Source Project, which leaves them exclusive to the Pixel OS.



GrapheneOS also questioned whether Google's legal team knows Pixels are getting months of early access to fixes and features. It called that edge over Google's partners very dubious.

Why a Galaxy or a Motorola phone waits until December

I went through Google's September Pixel Update Bulletin to see how much of this holds up, and the component list is the part that stands out. Settings, System UI, Bluetooth, NFC, Android Verified Boot and KeyMint all appear in it, and none of those are Pixel hardware.

The December date has a plainer explanation than it looks like it does, though. Google changed how it publishes Android source this year, and instead of pushing code out continuously it now does it twice, in Q2 and Q4, to keep the platform stable for everyone building on it.

QPR1 arrived in Q3, which falls between those two windows, so there was no source drop to attach it to. QPR2 lands in December, which is Q4.

If you are holding a Galaxy or a Motorola phone, the fair question is whether December changes anything for you in practice. Samsung ships its own monthly security updates and decides when platform fixes land in One UI, so the date that has ever mattered to a Galaxy owner is Samsung's rather than Google's.

GrapheneOS says its upcoming Motorola partnership will hand it firmware and driver code directly, which is a strange thing to need from a third party when Google is the one making Android.

What a December wait means for your security patches

If you are on a Pixel you already have the September 15 patch level, and installing it is the whole job.

If you are on anything else, the fixes for Settings, System UI, Bluetooth and NFC are not in your queue yet. Google's stated position is that these particular ones are not required for declaring a security patch level in the first place.

Where I land on Google's Android 17 patch split

I do not think this is Google being spiteful. But a calendar that leaves standard Android fixes sitting for three months is still a choice, and the company publishing both bulletins is the one that gets to explain it.

Google could clear most of this up in a sentence. I would like it to say plainly which of those platform fixes reach other manufacturers early and which genuinely wait for QPR2, so the rest of us are not piecing it together from a Mastodon thread.

More on Android 17 and this month's Pixel update:

• What the September Pixel Drop actually changed
• Everything Android 17 brings to your phone
• Google Pixel 11 Pro

• Follow me on X and Threads

Six-month unlimited plan is now 57% off

$90

$210

$120 off (57%)

Mint Mobile is now allowing you to get whichever plan you like for either three, six, or 12 months for just $15/mo. If you go for the six-month unlimited service, for instance, you'll now have to pay just $90 upfront instead of $210.

Buy at Mint Mobile