Field Notes

entity

CalyxOS

StatusWorkingReviewdue UpdatedStands on7 sourcesSupportsnotes

CalyxOS is an Android Open Source Project (AOSP) derivative published by the Calyx Institute, a New York 501(c)(3) nonprofit founded by Nicholas Merrill after his constitutional challenge to the USA PATRIOT Act’s National Security Letter statute.1 It is the main alternative to GrapheneOS among de-Googled Android distributions, and the two differ less in aim than in how much of the Android security model they are willing to modify to get application compatibility.

The project suspended releases for eleven months between August 2025 and July 2026, and returned on 1 July 2026 with version 7.2.2.0. That episode is the single most important fact about CalyxOS today and is documented in CalyxOS hiatus and return announcements.

What it provides

CalyxOS aims at privacy and usability on a broader hardware range than GrapheneOS supports:2

  • microG as an optional reimplementation of Google Play services, for notifications and location.
  • Datura firewall for per-application network control.
  • Seedvault encrypted backups.
  • Aurora Store for anonymous access to the Play catalogue, alongside F-Droid.
  • Verified boot with bootloader relocking on supported devices, which the project describes as keeping the Android security model intact.
  • Monthly OTA security updates, in normal operation.
  • Automatic disabling of Wi-Fi, Bluetooth, camera, and microphone when unused, and a Restrict USB feature.

Device support spans Pixel, Fairphone, and Motorola hardware across three tiers, with the Pixel 9a supported to April 2032.3 That breadth is the clearest practical advantage over GrapheneOS, which supports Pixel devices only until the announced Motorola partnership ships in 2027. A user who cannot buy a Pixel — for cost, availability, or import reasons — has no GrapheneOS option at all, and this is the case where CalyxOS is not a compromise but the only choice.

The microG decision

The central architectural difference is how each project makes Google-dependent applications work.

GrapheneOS runs Google Play as ordinary, unprivileged applications in the standard untrusted_app SELinux domain, subject to the same permissions as any other app. CalyxOS uses microG, which runs in the privileged system_app domain and relies on signature spoofing to present itself as Google Play services to apps that check.4

Signature spoofing is a genuine modification to the platform’s trust model, and microG’s own developers say so. Their published analysis answers “does it influence my security?” with “Yes,” while disputing the stronger claim that it breaks Android’s signature model outright: the mechanism affects post-installation signature queries rather than package installation, it requires a declared FAKE_SIGNATURE permission, a manifest declaration, and a developer-settings toggle, and it is therefore visible rather than silent.5

The honest summary is that this is a real weakening with a bounded scope, not a catastrophe and not nothing. The scope is what a reader should carry: an application that successfully imitates Play services can reach data other apps intended for Google, which is a confidentiality problem among installed apps rather than a break in the boot chain or the sandbox.

Hardening depth

Beyond the Google-compatibility question, the two projects differ in how much exploit mitigation they add to AOSP. GrapheneOS contributes a hardened allocator, hardened libc and kernel, memory tagging on Pixel 8 and later, attack-surface reductions, and a duress credential. CalyxOS’s published feature set is a privacy and control feature set; it does not claim an equivalent exploit-mitigation programme.

This is the difference that matters against the forensic-extraction threat Mobile operating system security comparison treats as primary. The Cellebrite capability evidence that distinguishes GrapheneOS is evidence about GrapheneOS’s mitigations, and it does not transfer to another AOSP derivative merely because that derivative is also de-Googled.

Three further criticisms are well known but are all dated 2022 and have not been re-verified here: that CalyxOS shipped Google’s privileged eSIM activation app with READ_PRIVILEGED_PHONE_STATE and no opt-out, exposing the IMEI; that it bundled the F-Droid privileged extension; and that it made no improvements to AOSP user profiles.4 Privacy Guides itself flags that article as more than four years old. Whether any still holds in the 7.x series is an open question, and is the first thing to check before citing them.

What the hiatus established

The project stopped shipping security updates on 1 August 2025 and resumed on 1 July 2026. It told users to uninstall the operating system, pushed a final OTA to reach people who had not seen the announcement, and said plainly that it could not guarantee its intended level of security in the interim. It estimated four to six months and took about eleven.

Two readings compete, and both are partly right.

The unflattering one is that a project whose product is security left its users without patches for the better part of a year, after two key departures, and missed its own estimate by a factor of two. An operating system that is not shipping is not secure whatever its design says, and this is a governance dependency that no architectural diagram displays.

The flattering one is that rotating signing keys after personnel with key access depart is textbook practice, not a symptom of disorder; that a project willing to tell users to stop using its product is behaving better than one that quietly ships stale builds; and that moving to hardware-security-module-based signing with an audited provisioning ceremony leaves the project in a stronger position than before.6

Both can hold. The synthesis is that CalyxOS handled a bad situation about as candidly as a project can, and that candour does not retroactively patch anyone’s phone.

The forward-looking question is whether monthly updates resume reliably, which is what Privacy Guides asked on the project’s return and what nobody can yet answer. Does CalyxOS sustain reliable security updates after its hiatus tracks it.

Where it fits

Choose CalyxOS when the hardware is not a Pixel, or when microG’s partial Google compatibility is preferable to installing Google Play at all, and when the threat model is commercial surveillance and data minimization rather than a well-resourced forensic adversary.

Choose GrapheneOS when the threat model includes physical device seizure or targeted exploitation, where its exploit-mitigation work and the Cellebrite evidence are the deciding factors, and Pixel hardware is available.

See also

  1. Calyx Institute: A Case Study in Grassroots Innovation, EFF Deeplinks, 3 April 2025, on the institute’s founding, nonprofit status, and programmes. Published four months before the founder’s departure. ↩

  2. CalyxOS hiatus and return announcements for the release history, and the project’s features page for the feature list. ↩

  3. CalyxOS device support documentation, on support tiers and bootloader relocking. ↩

  4. Should You Use GrapheneOS or CalyxOS?, Privacy Guides, 21 April 2022. Detailed and technically specific, but four years old and flagged as such by its publisher. ↩↩

  5. microG signature spoofing and its security implications, 2016, by a microG developer, conceding the security effect while disputing its characterization. ↩

  6. CalyxOS is back, LWN, July 2026, on the HSM signing solution and the Trail of Bits audit of the provisioning ceremony script. ↩

Built on 7 sources (7 external).

Working out connections…