Field Notes

synthesis

Mobile operating system security comparison

StatusStableReviewdue UpdatedStands on19 sourcesSupportsnotes

This note compares the four realistic choices for a security- and privacy-conscious phone in 2026: GrapheneOS on a Pixel, the stock Pixel OS, mainstream stock Android (Samsung and below), and iOS on a current iPhone. CalyxOS is treated in its own section below rather than as a fifth column, because it is a software choice made on top of the same hardware. The comparison runs across five threat axes: physical forensic extraction (Cellebrite-class), remote mercenary spyware (Pegasus spyware-class), commodity malware, the platform security model, and how friendly each system is to setting up a device for privacy.

The short version: GrapheneOS on a Pixel 8 or later is the strongest against physical extraction and the friendliest to privacy, an iPhone 17 leads stock systems against remote exploitation thanks to Memory Integrity Enforcement, stock Pixel hardware is the strongest stock Android platform but its software hardening and data-collection defaults trail both, and the rest of the Android market falls off steeply by vendor tier.

The shared baseline

The Android Platform Security Model documents the model every modern Android inherits: default-deny application sandboxing (discretionary user IDs plus SELinux mandatory access control), a layered permission system, verified boot from a hardware root of trust, file-based encryption keyed per user profile, and a hardware keystore escalating from a shared-CPU TEE to a discrete secure element. iOS implements a comparable architecture with its own app sandbox, secure boot chain, and Secure Enclave. Against this baseline, commodity malware such as ransomware largely fails on both platforms without any exploit at all, because no app can reach another app’s data.1 The meaningful differences are in what each vendor builds on top of the baseline: secure hardware, exploit mitigations, update cadence, and default data exposure.

Hardware roots of trust

The hardware tier decides what a seized device yields and how hard passcode guessing is:

  • Pixel 8–10 pair the Tensor SoC with the discrete Titan M secure element (Titan M2, RISC-V), Weaver-throttled key derivation, Insider Attack Resistance, and ARMv9 memory tagging (MTE) support. Pixel 10 (Tensor G5, 2025) keeps Titan M2 and adds a seven-year support commitment to August 2032.
  • Samsung flagships (Galaxy S21 and later) use Knox Vault, a dedicated secure processor with separate secure flash — architecturally the closest Android peer to Titan M2, with the deepest certification history (Common Criteria EAL4+, NIAP MDFPP, NSA CSfC). Samsung Knox shows the limits of that parity: Samsung Weaver has the same release-on-correct-key design, no MTE ships yet (a toggle is coming in One UI 9), and Cellebrite extracts S24-class flagships in BFU state where stock Pixels resist.
  • iPhones integrate the Secure Enclave, a dedicated core and power domain inside the SoC, with hardware passcode rate limiting. iPhones through the X (A11 and earlier) additionally carry checkm8, an unpatchable bootrom exploit, which leaves the enclave and passcode as the only barriers to forensic extraction on those models; the A12 generation (iPhone XS and XR, 2018) closed that path in silicon.
  • Everything else — most Xiaomi, Oppo, Motorola, and MediaTek-based devices — typically has only a shared-CPU TrustZone TEE, slower or absent updates, and in MediaTek’s case unpatchable boot-ROM vulnerabilities that leave before-first-unlock extraction open.2

Physical extraction (Cellebrite-class)

Leaked Cellebrite support matrices (2024–2025), analyzed in Cellebrite, produce a clear ranking:

Platform BFU (locked, never unlocked) AFU (unlocked once)
GrapheneOS on Pixel 6a+ Resisted Resisted; even an unlocked device resists extraction beyond the active session
Stock Pixel 6–9 Metadata only Full file system via USB exploits; no Titan M2 brute force
Samsung Galaxy S24-class Extractable (Inseyets 10.0, both Qualcomm and Exynos) Extractable
iPhone (current iOS) Resisted on recent models Extractable in principle; Lockdown Mode blocked FBI extraction on an iPhone 13
MediaTek / most non-Pixel, non-Samsung Android Often fully extractable Extractable

GrapheneOS’s resistance is structural rather than patch-based: hardware-level USB-C port disabling when locked, a hardened allocator that zeroes freed memory, configurable auto-reboot back to BFU, and generic exploit mitigations. Stock iOS and stock Pixel both remain vulnerable in the AFU state, because the forensic tools attack OS-level services over USB. Memory Integrity Enforcement on iPhone 17 is expected to raise the cost of these local chains as well, though it is too new to appear in the leaked matrices yet.

The cryptographic floor beneath extraction resistance

The platforms also differ in what remains if the secure-hardware throttle is ever defeated — the scenario the matrices assume away. Offline brute-force resistance of phone disk encryption works through the three architectural differences:

  • Android stretches the credential with scrypt at ~25 ms and 2 MiB, which AOSP itself concedes “usually does not provide much security” beyond the secure element’s throttle; Apple runs an ~80 ms key-tangle inside the Secure Enclave.
  • Android’s Weaver secret is a stored value the Titan M releases on correct-key presentation, so an offline attack is structurally possible (and chip-secret extraction was demonstrated on the original Titan M); Apple’s derivation key is fused into the silicon with no read path, so no offline fallback exists at all.
  • iOS discards its most sensitive data-protection class keys seconds after locking; Android keeps credential-encrypted keys resident for the whole session, with GrapheneOS’s auto-reboot and per-profile end-session as the available compensations.

On current hardware this changes no ranking — reaching the Pixel’s offline regime requires compromising a Titan M2 that no one has publicly compromised — but it means GrapheneOS’s documented lead rests on its exploit-mitigation layer holding, while a strong user passphrase is the backstop if it ever does not. Does AI-assisted vulnerability discovery erode mitigation-based security tracks whether that bet is getting better or worse.

Remote mercenary spyware (Pegasus-class)

No consumer configuration reliably stops a state-level operator with a current zero-click chain; the platforms differ in how expensive they make the attempt.

  • iOS has been the most frequently demonstrated zero-click target (iMessage chains such as FORCEDENTRY), but Apple has responded with BlastDoor, Lockdown Mode, the iOS 18.1 inactivity reboot, and now MIE, which Apple reports breaks rebuilt versions of recent real exploit chains and turns attempts into logged crashes.
  • GrapheneOS attacks the same problem with hardened_malloc, MTE enabled by default for the base OS and compatible apps, attack-surface reduction (disabled radios, ptrace restrictions, LTE-only mode), and a hardened WebView (Vanadium). No public forensic reporting has documented a GrapheneOS-specific zero-click compromise; its mitigations are generic, so exploit chains must be built against it specifically.
  • Stock Pixel benefits from the same AOSP mitigations plus Android 16’s opt-in Advanced Protection mode (MTE for supported apps, no sideloading, no 2G), but MTE is off for most code by default and the attack surface of bundled Google services is larger.
  • Other Androids combine bigger attack surface (vendor skins, carrier components) with slower patch delivery, and are where most documented Android spyware infections land.

Commodity malware

The asymmetry here is about app supply, not the OS kernel. Android’s open installation model means most real-world mobile malware — banking trojans such as Mamont, spyware, adware — arrives by sideloading or social engineering, with Kaspersky recording around 14 million mobile attack detections in 2025, overwhelmingly on Android.3 Google’s counterweight is Play Protect, which scans over 350 billion apps daily and blocked 266 million risky sideload attempts in 2025.4 Apple’s claim that there has never been a successful widespread malware attack against iPhone is consistent with the public record; iOS commodity malware is rare because sideloading is rare. On GrapheneOS the same open model applies, but the combination of Play Protect (under sandboxed Google Play), per-app network and sensor toggles, and the hardened base leaves a smaller target for a malicious app that does land. Android app distribution trust models covers how F-Droid and sideloading change the supply-chain side of this picture.

Privacy-setup friendliness

“Secure” and “privacy-friendly to set up” are different axes:

  • GrapheneOS is the only option that requires no account of any kind. The web installer runs from a browser in minutes, the bootloader relocks with verified boot intact, Auditor verifies the installation, and Google Play is optional sandboxed apps rather than a privileged system component. F-Droid, Accrescent, and Obtainium all work. The cost is user effort in choosing per-profile setups and accepting occasional app incompatibility.
  • Stock Pixel is setup-friendly but privacy-hostile by default: a Google account is pushed hard, telemetry and ad ID are on, and hardening features (Advanced Protection, MTE, 2G disabling) must be found and enabled. It is the best-hardened default Android experience.
  • iPhone requires an Apple ID for full function, collects substantial telemetry by default, and offers no sideloading outside the EU’s DMA-mandated alternative marketplaces; its privacy controls (Lockdown Mode, permission prompts, App Tracking Transparency) are polished but all-or-nothing — there is no per-app network toggle or profile isolation comparable to GrapheneOS user profiles.
  • Other Androids are the worst of both: vendor accounts and duplicated telemetry layered on top of Google’s, plus preinstalled components of varying quality.

The other de-Googled Android

CalyxOS is the main alternative to GrapheneOS among de-Googled AOSP derivatives, and it does not appear as a column above because it runs on the same hardware as the platforms that do. Every hardware row would be identical to the stock device it is installed on; the differences are entirely in software.

Two of those differences matter here.

CalyxOS uses microG rather than sandboxed Google Play, which runs in the privileged system_app SELinux domain and uses signature spoofing to present itself as Play services. GrapheneOS runs Google Play unprivileged in the ordinary untrusted_app domain. This is a real weakening of the platform’s trust model with a bounded scope, conceded as such by microG’s own developers.

CalyxOS also does not claim an exploit-mitigation programme comparable to GrapheneOS’s. That is decisive for the forensic axis: the Cellebrite evidence distinguishing GrapheneOS is evidence about its mitigations, and does not transfer to another derivative merely because that derivative is also de-Googled. Nothing in the leaked matrices speaks to CalyxOS, so its position on the extraction ranking is unestablished rather than favourable.

Against that, CalyxOS supports Fairphone and Motorola hardware as well as Pixels. For a user who cannot obtain a Pixel, the real comparison is not CalyxOS against GrapheneOS but CalyxOS against stock vendor Android, which it wins on privacy defaults and loses nothing on hardware.

Synthesis

Axis GrapheneOS on Pixel 8+ Stock Pixel 10 iPhone 17 / iOS 26 Samsung flagship Other Android
Secure hardware Titan M2 + Weaver + IAR Titan M2 + Weaver + IAR Secure Enclave Knox Vault (EAL4+) + Samsung Weaver Mostly TEE-only; MediaTek boot-ROM flaws
Memory-safety posture MTE on by default + hardened_malloc MTE selective (Advanced Protection) EMTE always on (MIE) No MTE yet (toggle coming in One UI 9) Rare
Forensic resistance (Cellebrite) Strongest documented AFU-extractable, BFU-resisted Lockdown Mode strong; MIE unpriced by vendors BFU-extractable on S24-class despite Knox Vault Often weakest
Mercenary spyware cost High; no documented chain Moderate Highest on stock systems post-MIE Moderate Low-to-moderate
Commodity malware exposure Low (sandbox + toggles) Moderate (sideloading, Play Protect) Lowest (closed install model) Moderate (Auto Blocker opt-in) Highest
Update cadence Rapid, ahead of stock on kernel LTS Monthly, 7 years Annual major + rapid response, ~7 years Monthly flagships, 7 years (S24+) Often quarterly or worse
Privacy out of the box Highest (no account, no telemetry) Low default, improvable Medium default, improvable Low Lowest

For the vault’s device-concierge venture (Privacy business proposals), the conclusion is unchanged but now better grounded: GrapheneOS on Pixel 10-class hardware is the defensible recommendation for customers whose threats include seizure or targeted surveillance, while an iPhone 17 in Lockdown Mode is a legitimate stock-OS alternative for customers who will not leave Apple’s ecosystem — with the caveat that iCloud backups, not the phone, are usually the weakest link in an iOS deployment.

Limits and open questions

The Cellebrite matrices are leaked vendor documents, not benchmarks, and MIE’s real-world effect on both spyware and forensic tooling is a 2025 claim awaiting independent confirmation. Comparative zero-click pricing between a hardened GrapheneOS target and an MIE iPhone is not publicly observable. Whether the Motorola partnership (GrapheneOS preinstalled on 2027 flagships)5 produces hardware meeting the full GrapheneOS requirements list — memory tagging, Weaver, IAR — remains open.

  1. See The Hated One on GrapheneOS. ↩

  2. See Cellebrite § Known capability boundaries. ↩

  3. The mobile threat landscape in 2025, Kaspersky Securelist, March 2026. ↩

  4. Keeping Google Play & Android app ecosystems safe in 2025, Google, February 2026. ↩

  5. Motorola partners with GrapheneOS for future phones, The Register, March 2026. ↩

Built on 19 sources (19 external).

Working out connections…