GrapheneOS Updates: How They Work and Why You Can't Skip Them
5 min read
Security updates are not optional. Every published vulnerability is a target — once it's documented in a security bulletin, attackers begin exploiting it within days. The gap between 'patch released' and 'patch installed' is the window of exposure.
GrapheneOS closes that window automatically. Your phone checks for updates every few hours, downloads them in the background, and applies them on your next reboot — without any action from you. Here's what's happening and why it matters.
The A/B Update System
GrapheneOS uses Android's A/B seamless update system. Your device has two system partitions — when an update arrives, it downloads and installs to the inactive partition while you continue using the phone normally. On your next reboot, the device switches to the updated partition.
If anything goes wrong during update installation, the device automatically falls back to the previous working partition. You cannot be stuck with a broken system. This is substantially safer than the single-partition update approach older Android versions used.
From your perspective: you receive a notification that an update is ready, you reboot, and you're on the new version. That's the entire process.
How Often Updates Come
GrapheneOS releases security updates monthly, aligned with Google's Android Security Bulletin. Critically, GrapheneOS often publishes its patches on the same day as or before Google's own Pixel OS updates — there's no delay waiting for manufacturer or carrier customisation, because there is none.
For actively exploited vulnerabilities, GrapheneOS publishes out-of-band patches outside the monthly schedule. The Updater app checks for updates approximately every 4–6 hours, so critical patches reach your device quickly.
What Updates Cover
- Android OS security patches (the monthly bulletin)
- GrapheneOS-specific hardening and security improvements
- System apps: Vanadium browser, PDF viewer, Camera, Contacts, and others
- Firmware updates: baseband, bootloader, Titan M security chip
- GrapheneOS infrastructure app updates (Updater, Sandboxed Play support, etc.)
Checking and Installing Updates
Settings → System → System update. The Updater shows your current version and checks for newer releases. If an update is available, tap to download — it installs in the background and notifies you when it's ready to apply.
To apply the update: reboot when prompted. The reboot takes about 2–3 minutes as the device switches to the updated partition and verifies the new system via Verified Boot.
What Happens if You Don't Update
Each uninstalled update represents known, documented vulnerabilities that could be exploited. GrapheneOS's sandboxing, memory hardening, and exploit mitigations reduce the practical impact of many vulnerabilities — but they're not a substitute for patching.
If you're travelling or offline: GrapheneOS continues checking in the background and will catch up as soon as connectivity is restored. There's no manual catch-up process required — just reconnect and reboot when prompted.
For enterprise or fleet use: we strongly recommend establishing a policy that devices are rebooted within 48 hours of an update notification.
App Updates
OS updates cover system apps but not apps you've installed separately. Keep these updated through their respective sources: Aurora Store for apps from the Play catalogue, F-Droid for open-source apps, and the sandboxed Play Store for apps requiring Play Services.
Aurora Store can auto-update apps: Settings → Auto-update → Always. F-Droid has a similar setting. Enable these and your app security posture updates alongside the OS.
Frequently asked questions
- Is GrapheneOS faster to patch than stock Android?
- Generally yes. GrapheneOS releases patches on the day of the Android Security Bulletin, with no carrier or manufacturer delay. Stock Android OEMs may take days to weeks to release patches to their devices; Google's own Pixels are typically as fast as GrapheneOS.
- Will updates break my installed apps?
- Monthly security updates don't affect installed apps. Major Android version upgrades (e.g., Android 14 to 15) occasionally cause minor app compatibility issues, but these are rare and GrapheneOS's release notes flag any known issues.
- How do I know what version I'm on?
- Settings → About phone → Build number shows your GrapheneOS version. The format includes the Android security patch level and GrapheneOS release date. You can also see this in Settings → System → System update.
- Do I need to do anything before updating?
- Finish any active tasks before rebooting to apply an update. The update itself downloads and installs in the background without interruption — only the reboot requires your attention.
Still have questions?
We answer personally — no ticket queue.