GrapheneOS rebuilds default apps while clipboard controls stop at profiles

Why it matters

GrapheneOS still ships several AOSP-descended utility apps alongside its hardened operating system. Replacing them without weakening security boundaries will determine whether users can get a coherent default experience without installing third-party substitutes.

In a September 6th development update, Daniel Micay (@DanielMicay), the security researcher who founded GrapheneOS in late 2014, is leading a broader rebuild of the ordinary applications bundled with the privacy- and security-focused Android operating system.

Public repositories and project discussions show work underway on Messaging, a replacement for the old Gallery and an overhaul of PDF Viewer. Clipboard access remains a mix of existing Android restrictions, a control for sharing between profiles and broader proposals that have yet to appear in the operating system's release notes as a general per-app permission.

The distinction between active development and a finished release matters. GrapheneOS is overhauling its default apps incrementally, starting with a rewrite of Messaging and a Gallery replacement adapted from existing software. The latest operating-system release notes do not present a completed default-app suite or a newly shipped general-purpose clipboard permission.

Micay built the hard parts first

Micay's priorities explain why GrapheneOS reached this point with sophisticated exploit defenses sitting beside aging utility apps.

GrapheneOS's official history describes the project as a solo effort at its founding and says it incorporated Micay's prior open-source privacy and security work. The initial engineering included porting OpenBSD's memory allocator to Android's Bionic C library and adapting PaX kernel patches for supported devices, before the work expanded into compiler, operating-system and application-sandbox hardening.

GrapheneOS was previously known as CopperheadOS while Copperhead sponsored the work. The relationship ended in a dispute over control of the code and organization, documented by GrapheneOS and examined in WIRED's account. Micay continued the operating system independently. The Canadian GrapheneOS Foundation was established in March 2023, and the project's history now describes a team with multiple full-time and part-time developers.

The project does not disclose a venture round, valuation, public user count or total donations. Its funding page says donations from individuals, companies and organizations pay for developers, hardware, infrastructure and legal expenses.

That history produced a clear engineering hierarchy. GrapheneOS concentrated its limited resources on security boundaries, exploit mitigations and operating-system infrastructure. Apps that users could replace received less attention.

The result was a technically unusual mobile operating system with some conspicuously old default software. GrapheneOS develops Vanadium, its hardened Chromium-based browser and WebView, along with Camera, Auditor and PDF Viewer. Its source documentation identifies Calculator, Clock, Contacts, Files, Gallery, Messaging and Phone as applications largely descended from the Android Open Source Project.

A prettier gallery does little good if the underlying phone is vulnerable. Aging defaults still create a usability gap, especially when users must replace bundled apps to get a current interface.

Messaging gets a rewrite

The GrapheneOS Messaging repository shows the operating system's bundled messaging client moving from its legacy Java and Android Views foundation toward Kotlin and Jetpack Compose, Google's current toolkit for native Android interfaces.

This is substantial maintenance work. The application's Android manifest declares permissions to read, receive and send SMS or MMS messages, along with handlers for related messaging intents. The repository does not establish broader claims about carrier-message handling, secondary-user behavior or access to permissions unavailable to ordinary applications.

For now, the rewrite addresses a basic weakness in the default experience: users of a security-focused operating system still expect its bundled messaging client to receive active maintenance.

Gallery adapts an existing app

The GrapheneOS Gallery repository identifies the underlying application as Refra, an open-source media application built with Jetpack Compose.

That choice directs scarce engineering time toward adapting and reviewing existing software. GrapheneOS can change packaging, remove broad file access and apply its own release process without recreating an entire media application. The repository's README says a nomaps variant removes map features and related permissions such as internet access.

In a public preparation issue, project contributors list work including changing the package name, replacing the old system Gallery, pinning dependencies, adding GrapheneOS branding, removing All Files Access, testing the fork for inclusion, adjusting GitHub Actions and updating the README. The task remained open, so it documents preparation for inclusion rather than a completed replacement. The release notes have not marked the Gallery replacement as a finished stable rollout.

The GrapheneOS PDF Viewer repository describes the security model behind that application. According to its README, PDF Viewer passes a document stream into a sandboxed WebView without access to the network, files or other content providers. The README also says its Content Security Policy restricts code and styling inside the viewer to static APK assets and blocks custom fonts. That isolation gives changes to the viewer consequences beyond interface polish.

Clipboard controls remain fragmented

GrapheneOS's existing clipboard model limits reads to the focused app and selected keyboard. The project's FAQ also describes Android's notification when an application reads clipboard content copied by another app.

GrapheneOS added a narrower profile control in its May 19th, 2025 release. The Private Space setting lets users block clipboard sharing to or from its parent profile and other nested profiles. It governs data crossing profile boundaries rather than supplying a permission switch for each application.

A separate issue proposed stronger per-app restrictions, but that issue was closed as "not planned." Its proposals included app-specific restrictions, confirmation before cross-app pasting and faster clipboard clearing.

A different clipboard-control request, opened in December 2023, asks for global and per-app controls. The public record establishes demand and discussion, while the release notes provide no implementation or release date for a general per-app clipboard permission.

Such a control would have to coexist with paste menus, keyboards, accessibility tools and applications built around standard Android behavior. For now, it remains a request rather than a documented product feature.

A narrow position among Android alternatives

GrapheneOS competes for privacy-conscious Android users with projects including CalyxOS, /e/OS and LineageOS. CalyxOS, a privacy-focused Android distribution, offers phones preinstalled through a membership program and uses microG as an open-source substitute for Google services. Murena's /e/OS, another Android-based alternative, bundles its own applications and services around a de-Googled experience. LineageOS serves the broader aftermarket Android community.

GrapheneOS takes a narrower hardware and security approach. It focuses primarily on supported Google Pixel devices, emphasizes hardened sandboxing and exploit mitigations, and permits users to install Google Play through a sandboxed compatibility layer. That model can reduce hardware choice, but it also gives the project a tighter set of devices and security boundaries to maintain.

The default-app overhaul tests whether that discipline can extend through the rest of the user experience. Messaging, Gallery and PDF Viewer are routine tools, yet each creates permissions, file-handling and maintenance decisions that matter on an operating system built around reducing attack surface. Micay's project now has to make those applications feel current without relaxing the security model that distinguishes GrapheneOS from other Android distributions.