Hacker News
points by MarkBlah 10 hours ago | 0 comments
triage seems outsourced for android, messages like "we will forward this to the android team". This seems to have been a communication issue, they set it as Will Not Fix, they 'fixed' the bug by adding try/catches further up the chain in upcoming release, i missed that before i submitted.

they did set it as a duplicate of a ticket they disregarded.

I found the Chrome team the easiest to communicate with, devs would actually respond.

page updated to reflect.

[–] grapheneos 4 hours ago
The issue is assigned CVE-2026-58882, has Critical severity and is part of the November 2026 security patch level. OEMs received the patch in July 2026 and have been allowed to ship it since then. That's how the patch system now works for Android. GrapheneOS has access to the security preview patches so we got it patched for our users in July 2026.

Android's public issue tracker isn't the real issue tracker. They create internal issues for what's reported there. That means the discussion about it doesn't happen there. Security bug reports are mainly treated as a request for a bounty and little communication happens beyond what's related to receiving a bounty for it. If someone else filed it then it gets closed and no further info is provided. If someone external filed the first report, they hardly get any updates themselves beyond eventually being informed which Android Security Bulletin included it months after it was disclosed to OEMs and allowed to be patched.

[–] mrb 9 hours ago
Sorry you went through that! It must be frustrating.
Hacker News