GrapheneOS Is Rebuilding Its Default Apps—and Rethinking Clipboard Privacy

Picture a freshly installed privacy-focused phone. The permission screens are careful, the app sandbox is strong, and Google services are optional. Then you open the included Gallery and find an app that feels like it was left behind by Android years ago.

That mismatch explains GrapheneOS’s current push. The project is rebuilding the default apps people use every day while designing a new way to paste sensitive information without giving every app a wide view of the clipboard. The announcements made on September 6, 2026, point to a broader shift: privacy should be visible in the ordinary moments, not only in the operating system’s deepest layers.

Why bundled apps matter more than they seem

GrapheneOS is based on the Android Open Source Project, usually shortened to AOSP. AOSP is the public foundation of Android, containing the operating system code and a set of basic applications that manufacturers can adapt. Those basic apps are functional, but some have received less attention than the polished proprietary apps shipped on mainstream phones.

AOSP Gallery is the clearest example. GrapheneOS says it is too outdated to serve as a useful starting point, so the project plans to replace it rather than apply another round of small repairs. The team has also mentioned a possible overhaul or replacement for AOSP Keyboard, along with broader work on the remaining bundled applications.

This is more than a cosmetic complaint. A default app is the first tool many people use after installing an operating system. It establishes whether the phone feels complete, whether files and photos are handled predictably, and whether users need to install another application that may request additional permissions or network access. A secure foundation paired with neglected everyday tools creates an awkward gap between the system’s promises and the experience in your hand.

GrapheneOS historically concentrated much of its effort on the base operating system because users could install alternative apps. The project now says it is increasing investment in its own bundled apps as well, helped by new hires and additional development resources.

Messaging is getting a real rewrite

The first major example is Messaging. GrapheneOS described a completely overhauled interface written with Android Compose, formally known as Jetpack Compose. Compose is Android’s modern toolkit for building native interfaces with Kotlin. Instead of manually changing individual interface widgets every time data changes, developers describe what the screen should look like for the current state, and Compose updates the screen accordingly.

That style is called declarative user interface development. The term sounds abstract, but the practical effect is easier to picture: a conversation list can describe itself as “show these threads, with these unread counts, in this layout,” rather than relying on a long chain of commands that individually modifies rows, labels, and buttons.

A rewrite also creates room for better large-screen behavior, more consistent theming, and a cleaner foundation for accessibility and testing. It does not guarantee that every desired feature arrives at once. The public GrapheneOS release page listed version 2026081300 on the stable and beta channels and 2026090500 on the alpha channel as of September 7, 2026. The app work is moving quickly, but the announcements describe an active development program rather than a finished replacement for every bundled app.

RCS without making Google Messages the permanent answer

A major part of the Messaging roadmap is RCS, or Rich Communication Services. RCS is a carrier-backed messaging standard designed to provide features that traditional SMS and MMS lack, such as richer media, typing indicators, delivery status, and modern group conversations.

On GrapheneOS today, RCS, including end-to-end encryption in supported situations, is available through Google Messages. End-to-end encryption means that a message is protected on the sender’s device and decrypted only on the intended recipient’s device. The service carrying the message should not be able to read its contents.

GrapheneOS wants to reduce the need for Google Messages eventually. The initial plan is to implement the portion of RCS currently handled by Google Messages, with sandboxed Google Play potentially still required for activation and related functions. Sandboxed Google Play means Google’s components run as ordinary apps inside a selected user profile rather than receiving the privileged operating-system access they commonly receive on standard Android.

The project is also looking toward Messaging Layer Security, or MLS. MLS is an Internet Engineering Task Force standard for establishing and updating encrypted group keys, including protections known as forward secrecy and post-compromise security. In plain language, it is designed to limit the damage from an exposed key and to keep old conversations protected when a group’s membership or encryption state changes.

There is an important caveat here. GrapheneOS describes RCS and MLS support as a longer-term plan, not as a feature that the rewritten Messaging app already provides independently. The team also points out that RCS is not truly open in everyday use because it depends heavily on proprietary Google and carrier infrastructure.

The clipboard problem is about access, not only previews

Why rethink something as ordinary as copy and paste? The clipboard looks like a temporary shelf, but it is actually a system-wide handoff point. Apps use a clipboard application programming interface, or API, to place data there and retrieve it later.

Android has already tightened clipboard behavior. Since Android 10, only the currently focused app and the active keyboard can read clipboard contents; background apps cannot quietly inspect it. Android 12 added a notification when an app reads content copied by another app. Android 13 also introduced a sensitive-content marker that can hide passwords or card numbers from the visual clipboard preview.

That marker is useful, but it is not an access control. It tells the system how to display a clip; it does not prevent an allowed app from reading the data. A foreground app can still use the traditional clipboard API when the operating system considers it the active reader.

GrapheneOS’s proposed secure paste feature takes a different approach. The project says users will be able to remove clipboard access from an app and use secure paste instead. The feature is intended to work through the standard text-selection toolbar, input methods, accessibility services, and keyboard shortcuts, so apps can still receive information through an explicit user action without receiving unrestricted clipboard access.

Imagine copying a password from a password manager and placing it into a banking app. Under the proposed model, the banking app could be denied ordinary clipboard access while the user still invokes secure paste into the password field. The app gets the value needed for that interaction, but it does not automatically gain the same opportunity to inspect whatever the user copied earlier.

That distinction matters. A blunt clipboard ban would break legitimate workflows, especially for keyboards, accessibility tools, password managers, and remote-input features. GrapheneOS says the goal is to preserve compatibility while targeting the most problematic part of the existing design: silent or unnecessary cross-app reading.

A more complete privacy experience

The common thread connects the rebuilt apps, RCS work, and secure paste. GrapheneOS is moving beyond the idea that privacy lives only in kernel hardening and permission switches. The apps people open, the services they depend on, and the data-sharing paths they barely notice all shape the real security boundary.

The project’s Storage Scopes and Contact Scopes features already follow this pattern by giving apps selected files or contacts instead of an all-or-nothing view. A secure paste feature would extend the same idea to text and other clipboard data.

None of this arrives as one dramatic switch. The Gallery replacement, modern Messaging interface, independent RCS support, and secure paste feature are parts of a longer rebuild. Still, the direction is clear: a privacy-focused phone should not require users to trade away usability every time they open a default app or paste a password. The strongest security improvement may be the one that quietly makes the safer choice feel normal.