What this is

This is a Google Pixel 10 Pro with GrapheneOS flashed in place of stock Android. GrapheneOS is an open-source, security-focused Android fork that ships without Google services by default and adds substantial hardening on top of AOSP. The Pixel hardware is chosen deliberately: it is the only line GrapheneOS officially supports, because it provides a complete hardware security stack (Titan M2 secure element, verified boot with user-controlled keys, and a properly isolated cellular baseband).

Why the Pixel 10 Pro specifically

The 10 Pro runs the Tensor G5, the first generation built by TSMC on a 3 nm process, and carries 16 GB of RAM. Crucially for this threat model, it supports ARMv9 hardware memory tagging (MTE), which GrapheneOS enables by default for the base OS and compatible apps to catch memory-corruption exploits probabilistically. As an 8th-generation-and-later Pixel, it falls under Google's extended 7-year update guarantee, giving GrapheneOS firmware and OS updates into 2032 — the longest support window currently available on supported hardware.

Honest positioning

GrapheneOS meaningfully shrinks the remote-attack and data-at-rest surface: hardened memory allocator, network/sensor permission toggles, Storage and Contact Scopes, a hardware-backed Auditor for verifying device integrity, and features like a duress PIN and auto-reboot. It does not change physics or law. Your carrier still sees your SIM, a forensic lab still has techniques, and your own account logins still tie activity to you. Treat this device as a strong baseline that you must operate carefully — not as a guarantee of anonymity.

Usage guide

Before you start

• Confirm the device is a genuine Pixel 10 Pro (model GEHN3 / G4QUR / GN4F5) and that the bootloader can be unlocked (carrier-locked units from some US carriers cannot).
• You need a computer with a Chromium-based browser (Chrome, Edge, Vanadium on another GrapheneOS device) and a good-quality USB-C cable. The official method is the web installer.
• Read the full official installation guide end to end before touching anything. Do not follow third-party YouTube tutorials.

Installation

1. Power on, complete minimal stock setup, then enable Developer options and turn on OEM unlocking and USB debugging.
2. Reboot to the bootloader, connect to your computer, and run the web installer. It will unlock the bootloader (this wipes the device), flash the GrapheneOS factory images, then re-lock the bootloader. Re-locking is mandatory — it re-enables verified boot with GrapheneOS's keys.
3. After the first boot, verify the boot state. GrapheneOS uses a yellow/locked verified-boot state with its own key; a locked bootloader plus the GrapheneOS key fingerprint is what you want.

Verify integrity

• Install the Auditor app (bundled with GrapheneOS). Use local attestation by pairing with a second Android device via QR codes, or enable scheduled remote attestation through attestation.app for email alerts if the device's hardware/firmware state ever changes. This is your strongest check that the OS and bootloader have not been tampered with.

Daily use

• Keep the bootloader locked at all times. Updates are delivered over-the-air and applied to a second slot, so you never need to unlock again.
• If you need Google apps, install Sandboxed Google Play from the GrapheneOS Apps repository. It runs as an ordinary unprivileged app inside the sandbox rather than as a system component. Prefer not installing it at all if your workflow allows.
• Use the per-app Network and Sensors permission toggles to deny connectivity and motion/environment sensors to apps that do not need them.
• Use Storage Scopes and Contact Scopes to hand apps a curated, fake-empty view instead of granting blanket storage or contacts access.

Hardening checklist

• Set a long, random passphrase (not a short PIN) as the primary unlock secret; encryption strength is bounded by it.
• Enable PIN scrambling (Settings > Security) so a shoulder-surfer or camera cannot learn your PIN from finger positions.
• Configure the auto-reboot timer (default 18 hours) so the device returns to the at-rest, Before-First-Unlock state if it sits unattended; lower it if your threat model warrants.
• Set USB-C port to *Charging-only when locked* under Settings > Security > Exploit protection to disable data lines while locked.
• Consider a duress PIN/password: entering it irreversibly wipes the device (including installed eSIMs). Understand that this is destructive and irrecoverable before enabling it.

Pitfalls

• The baseband still talks to the carrier. GrapheneOS isolates the baseband via the IOMMU, but connecting to a network reveals your identifiers. For true radio silence, use airplane mode — and remember it does not retroactively hide where you already were.
• Sandboxed Play re-introduces a Google account if you sign in. Decide consciously whether that fits your threat model.
• eSIMs are wiped by a duress wipe and by factory reset. Keep activation details recoverable through your carrier.
• Re-locking is non-negotiable. Leaving the bootloader unlocked disables verified-boot tamper protection.

Further reading

See the official features overview and FAQ for the authoritative description of every mechanism above, and the usage guide for ongoing operation.