GrapheneOS's rewritten texting app reached 280 points on Hacker News inside its first day, uncommon attention for a system SMS client. The code explains some of that interest: 707 commits separate version 13 from version 12. Yet the decision that defines the release is outside those commits. The built-in app remains focused on SMS and MMS, while GrapheneOS routes RCS support through Google Messages and sandboxed Google Play. Users who want a modern texting app without that Google layer now have a much better option, with the same old transport ceiling.
Version 13 was published on September 11 with a signed tag. GrapheneOS says it replaced the legacy interface, rebuilt every screen, added large-screen support, and fixed faults across message handling and notifications. The release bundles a year of accumulated work into one version.
A new interface tied to new behavior
Jetpack Compose and Material 3 now drive the interface, including a two-pane conversation view for large screens and correct handling for display cutouts in both orientations. The release notes also name a new adaptive icon and an onboarding flow that explains permissions, default-app setup, and SMS privacy. Compose matters here because the project used the migration to replace the whole screen layer instead of wrapping the previous views in new colors and shapes.
The daily-use changes are easy to recognize. Conversations can be pinned, archived with a swipe, marked unread, or snoozed for fixed periods and indefinitely. Multi-select actions now cover deletion and blocking, while status markers identify work-profile threads and incoming MMS state. Inside a thread, version 13 adds an SMS segment counter, editable MMS subjects, multi-message deletion, and a details screen with timestamps and delivery status. All of those items appear in the project's version 13 change summary.
Media and sharing received their own rebuild. The app uses Android's embedded photo picker, adds captions to attachments, and has new viewers for photos and vCards. Its share picker can search recent conversations and contacts, preview content, and choose a SIM before sending. The same release notes say share failures are now visible and attachments are no longer silently dropped by share intents. That last fix is small on a feature list and severe in use: a messaging app must tell the sender when part of a message never left the phone.
Some changes repair state rather than appearance. GrapheneOS says a message that arrives while its conversation is being deleted will no longer be destroyed. Archive changes are no longer overwritten during synchronization, unread notifications survive reboots, and a race between MMS downloads and notifications has been fixed. The message-handling section also says incoming SMS is imported immediately and failed-message alerts are delivered correctly. These fixes address message loss and stale state, failures users cannot solve by learning a new interface.
Accessibility work spans screen-reader labels, full weekday names in spoken timestamps, focus behavior in the conversation list, and state announcements for swipe actions. The app now announces a successful send with sound as well. For GrapheneOS's multiple-profile model, version 13 labels work conversations and gives secondary-user notifications unique IDs; pending MMS still has to be retrieved by the Owner user before other users can read it.
The security work sits at the input boundaries
Android messaging clients ingest data from several directions: carrier messages, shared files, notification actions, contact cards, and media metadata. Version 13 tightens those boundaries. According to the privacy and security notes, shared-content checks reject file: URIs and private app files, verify permissions for content URIs, and apply the same private-file rules when text arrives through a content URI. Widget receivers are no longer exported, widget intents stay inside the app, and pending intents are immutable where mutation is unnecessary.
The parsers also get explicit allocation limits for EXIF APP1 data, MMS PDUs, and MMS content types. GrapheneOS fixed missing dimension checks before native image transcoding, null dereferences involving GIFs, and upstreamed corrections in the AOSP vCard parser. These changes reduce the amount of trust placed in attacker-controlled sizes and structures. The project does not attach CVE identifiers or claim known exploitation. The proper label is hardening and bug fixes, with no disclosed attack attached.
Link previews follow the same cautious default. YouTube previews are opt-in and disabled until a user turns them on, according to the release notes. A preview can reveal a request to a third party and fetch remote material before the recipient opens the link. Making that network action explicit fits a privacy-focused operating system, while still leaving the convenience available.
SMS honesty meets the RCS gap
The new onboarding tells users that SMS is unencrypted and recommends end-to-end encryption for sensitive messages. That warning is part of the app's own release description, and it puts the protocol limit where a user encounters the product. A safer parser can protect the phone from malformed input. It cannot add confidentiality to a carrier transport that lacks it.
GrapheneOS says ordinary calling, SMS, and MMS work with carriers that Google officially supports on Pixel devices. RCS follows a different path. The project's carrier and RCS guide documents RCS only through Google Messages with sandboxed Google Play, and currently only in the Owner profile. Depending on the carrier, Play services may need phone permission and access to ICC authentication; Google Messages must also become the default SMS app. Those requirements place RCS outside the built-in client's Google-free path.
That split explains much of the community reaction without turning comments into product evidence. In the Hacker News discussion, readers repeatedly compared the new client with Google Messages and debated whether missing RCS was a deal breaker. The 280-point score measures attention alone. GrapheneOS's documentation supplies the factual boundary: version 13 modernizes its SMS/MMS app, and its RCS instructions name another app.
There is still a practical audience for this choice. SMS remains a fallback for account codes, service notifications, and contacts outside encrypted messengers; MMS persists for carrier group threads and attachments. GrapheneOS's usage guide says both protocols are supported, while the version 13 notes add better multi-SIM selection, MMS status, and failure reporting. The rewrite improves the part of phone messaging that cannot simply be removed. Carrier transport and its privacy limits remain unchanged.
The Android floor is intentionally high
Version 13 sets minSdk to 36 and both targetSdk and compileSdk to 37. Google's API-level table maps those numbers to Android 16 and Android 17. Android blocks installation when a device is below an app's minimum API level. Devices on Android 15 or earlier therefore cannot install this source tree as a replacement texting app. The high floor narrows sideloading compatibility to Android 16 and newer.
The toolchain is similarly recent: Kotlin 2.4.10, Android Gradle Plugin 9.3.2, and Gradle 9.7.1, with Compose Adaptive and Navigation 3 among the added components. GrapheneOS says unit tests, instrumented tests, builds, and static analysis run on each pull request. CI cannot rule out regressions after a 707-commit jump. It does give contributors a visible check on the new data, domain, and Compose layers.
The comparison with version 12 begins at a tag dated August 5, 2025 and ends at the September 11, 2026 release, with GitHub reporting 707 commits. That count measures development activity; many commits are maintenance or integration work rather than user-facing additions. It does show why this release carries interface migration, behavior changes, parser work, and tests under one version number. The public diff also gives Android developers a way to inspect how a long-lived messaging client moved to Compose without replacing its carrier-facing core.
What to watch after version 13
Distribution is the immediate question. The official GrapheneOS forum announcement points to the GitHub notes, while replies ask when the build will reach the project's app store and include a user report of alpha-channel availability. The reply provides no official confirmation of a stable rollout. Stable-channel delivery and the first bug reports from everyday conversations will provide better evidence than release-day enthusiasm.
After that, watch whether GrapheneOS brings RCS into its own client or continues to treat Google Messages as the compatibility route. The current guide still requires Google Messages for RCS, while version 13 gives the built-in app a modern interface and tighter input handling. The release has a clear job: make SMS and MMS less dated and less error-prone. Its longer-term value will depend on how well the rewrite holds up in stable use, and whether the protocol boundary moves.