The paper has a table listing the patches they're inaccurately claiming are missing in GrapheneOS. They claim the ones marked as green were manually verified to be missing. The first patch listed in the table is CVE-2015-6609, which we reported to Google in 2015.
https://source.android.com/docs/security/bulletin/2015-11-01#acknowledgements
GrapheneOS
npub1kw…se0nj
2026-08-08 04:30:09 UTC
in reply to nevent1q…6r3z
Author Public Key
npub1kwarc5z9lwhen05uknd2nuwhhthd4ws0cku3t9j3rchm0fcd6luslse0njPublished at
2026-08-08 04:30:09 UTCEvent JSON
{
"id": "398dd5b506985ac5481ec791cd038a027ba1e093257c06db2d5400c351b1db0b",
"pubkey": "b3ba3c5045fbaf99be9cb4daa9f1d7baeedaba0fc5b91596511e2fb7a70dd7f9",
"created_at": 1786163409,
"kind": 1,
"tags": [
[
"e",
"d1eb569d905c35e7f6fcd09f87dce264b9a32cab210ffee081fb97b12339d947",
"",
"reply",
"b3ba3c5045fbaf99be9cb4daa9f1d7baeedaba0fc5b91596511e2fb7a70dd7f9"
],
[
"proxy",
"https://grapheneos.social/@GrapheneOS/117058005174361905",
"web"
],
[
"p",
"b3ba3c5045fbaf99be9cb4daa9f1d7baeedaba0fc5b91596511e2fb7a70dd7f9"
],
[
"e",
"b8a1d9dc6c1e678bba819a6461a31144276c45e7ba2c7d47226812534de85628",
"",
"root",
"b3ba3c5045fbaf99be9cb4daa9f1d7baeedaba0fc5b91596511e2fb7a70dd7f9"
],
[
"proxy",
"https://grapheneos.social/users/GrapheneOS/statuses/117058005174361905",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://grapheneos.social/users/GrapheneOS/statuses/117058005174361905",
"pink.momostr"
],
[
"-"
]
],
"content": "The paper has a table listing the patches they're inaccurately claiming are missing in GrapheneOS. They claim the ones marked as green were manually verified to be missing. The first patch listed in the table is CVE-2015-6609, which we reported to Google in 2015.\n\nhttps://source.android.com/docs/security/bulletin/2015-11-01#acknowledgements",
"sig": "3d7a68a78deaa683dbd457b03f8d17b80311a6523493c086553614bed55e1c6b367be6a5ff447e72f047d57fea6a467905d5599fd29cbd1f97cde10587be5c6d"
}