GrapheneOS Messaging 13 rebuilds its SMS app with privacy and security fixes

GrapheneOS has released version 13 of its Messaging app, replacing the legacy interface with a Jetpack Compose and Material 3 rebuild. The release notes say every screen has been rebuilt, with new conversation controls, large screen support, and fixes across crashes, notifications, security, and message handling.

The practical change is that GrapheneOS users now get a more modern SMS and MMS client without handing the default messaging role to a larger commercial app. The project lists a two pane conversation layout for large screens, a redesigned archive view, swipe actions for archive and unread status, conversation pinning, and notification snoozing for 1, 8, or 24 hours, or indefinitely. Those are everyday quality of life features, but they matter more on a privacy focused Android distribution because the default app has to carry both usability and trust.

Security and reliability move together

The release is not only a visual refresh. GrapheneOS says version 13 rejects shared file: URIs and private app files, checks content URI permissions, restricts widget intents to the app, and uses immutable pending intents where mutability is not required. The notes also mention allocation limits for EXIF APP1, MMS PDU, and MMS content type parsing, along with fixes for GIF null dereferences and missing dimension checks before native transcoding.

For readers, the useful signal is that messaging apps are not simple text boxes anymore. They parse photos, videos, contact cards, shared links, notifications, widgets, and carrier specific message formats. A privacy oriented messaging client has to reduce accidental data exposure while still surviving messy input from other apps and networks.

What changes for users

• Messages arriving during conversation deletion are no longer destroyed.
• Incoming SMS messages are imported immediately.
• Unread notifications survive reboots.
• The app adds an onboarding flow covering SMS privacy, permissions, and default app setup.
• The required platform versions move to minSdk 36, targetSdk 37, and compileSdk 37.

CyberOGZ sees this as a small but telling mobile security story. GrapheneOS is still limited to a narrower device audience than mainstream Android, yet releases like this show where privacy projects spend their engineering budget: not only on hardening the operating system, but also on replacing familiar daily apps with versions whose security boundaries are easier to defend. The tradeoff is that SMS itself remains unencrypted, a point GrapheneOS now calls out during onboarding while recommending end to end encryption for sensitive conversations.

Sources

• github.com

Cover photo by Rahul Shah on Pexels, used under the Pexels License.