May 2025 anti-rollback bootloader protection - fatal problem or not an issue?

worrieduser

My Pixel 8 Pro seems to have a very recent stock firmware and stock Android 16; the build number is BP3A.251005.004.B2 from October 2025. I want to try GrapheneOS.

There was a confusing announcement by Google about "May 2025 monthly release" saying:
"Warning: The May 2025 update for Pixel 6 (6, 6 Pro, 6a) and Pixel 8 (8, 8 Pro, 8a) devices contains a bootloader update that increments the anti-roll back version for the bootloader."

Will this be a fatal problem for using GrapheneOS? I've read/searched GrapheneOS's release notes for all releases from May 2025 until now and did not find anything about interactions with May 2025 bootloader anti-roll back protection. However, on XDA, people installing custom ROMs have had their devices bricked (likely NOT in conjunction with GrapheneOS) when they manually upgraded firmware to releases after May 2025.

Is there a problem here? Or is it safe to install a recent (October 2025) build of GrapheneOS on this Pixel 8 Pro?

Is there anything I should check before proceeding? (aside from unlocking the bootloader)

Thank you so much!

23Sha-ger

worrieduser However, on XDA, people installing custom ROMs have had their devices bricked

Because most of those shitty ROMs don't support verified boot and require you to disable it before flashing. Then some people lock the bootloader and get bricked devices.

GrapheneOS will install fine with from any stock version.

torx

worrieduser However, on XDA, people installing custom ROMs have had their devices bricked (likely NOT in conjunction with GrapheneOS) when they manually upgraded firmware to releases after May 2025.

My Pixel 8 Pro (running GrapheneOS with an unlocked bootloader) was just apparently permanently bricked by this after a manually applied OTA.

Obviously, this is not a risk for the overwhelming preponderance of users, but I'm posting here because I didn't realize it was a risk at all and only started finding these references after the device became completely unresponsive.

As the XDA thread you linked says "This is a catch-all thread for all 6 and 8 series Pixels, intended to prevent users from bricking those Pixels due to the May 2025 firmware update which has an anti-rollback bootloader, so both slots must be updated properly in order to avoid being permanently bricked" and underscored "If you're already bricked, then it's too late, and the only solution is trying to get it covered by Google."

Hopefully others can avoid having this happen on their GrapheneOS devices.

worrieduser

23Sha-ger Does it mean that after May 2025 GrapheneOS somehow incorporated whatever changes Google made to the bootloader code?

There are no relevant mentions of bootloader in GrapheneOS release notes from May 2025 until now...

With some ROMs, one might think that they do not touch the bootloader, but GrapheneOS indeed touches the bootloader because locking it is recommended after installing. So, it would seem that if Google makes a bootloader-related change, then GrapheneOS might be affected.

worrieduser

23Sha-ger Sorry for a possibly stupid question, but are October builds of GrapheneOS for Pixel 8 Pro based on Android 15 or 16?

No, the May 2025 rollback protection-related hard bricks were not about locking the bootloader on a custom ROM. I know not to do the latter...

I hope it's not against the rules to post links, but this is what I am taking about:

https://xdaforums.com/t/may-2025-and-newer-beware-of-permanent-bricks-if-you-dont-handle-the-anti-rollback-bootloader-correctly-on-all-pixel-6-6-pro-6a-8-8-pro-8a.4735780/

https://old.reddit.com/r/pixel_phones/comments/1kgto55/may_update_anti_rollback_bootloader_update/

23Sha-ger

worrieduser
GrapheneOS is not affected as long as the bootloader can be unlocked. The installer then wipes and flashes it's own partitions and keys no matter what Google had with stock.
The only way they can cripple anything is if they force an update that will make all devices currently running stock "bootloader locked" without a possibility to unlock, but that's highly unlikely, if they would do it they would do it on newer generation of devices.

raccoondad

worrieduser are October builds of GrapheneOS for Pixel 8 Pro based on Android 15 or 16?

torx

23Sha-ger Because most of those shitty ROMs don't support verified boot and require you to disable it before flashing. Then some people lock the bootloader and get bricked devices.

That isn't the bricking path in this case. What actually happens is the device enters a pre-bootloader/blown e-fuse type state that cannot be exited.

Again, my GrapheneOS device had a completely unlocked bootloader. The wrinkle was one slot had the 2025110800 OTA applied and the other was GrapheneOS from before May 2025. Presumably this risk will happen any time Google releases updated bootloaders w/ anti-rollback.

ryrona

Just to give a super clear answer:

It is possible and safe to install GrapheneOS on a phone that has the latest bootloader version. This is fully supported and won't risk bricking your phone at all. In fact, GrapheneOS installation will update the bootloader to the latest version for you, if it isn't already.

You should lock the bootloader again after installing GrapheneOS, as the security of GrapheneOS relies on the bootloader being locked. Follow all steps in the installation guide.

monogram

torx Again, my GrapheneOS device had a completely unlocked bootloader. The wrinkle was one slot had the 2025110800 OTA applied and the other was GrapheneOS from before May 2025. Presumably this risk will happen any time Google releases updated bootloaders w/ anti-rollback.

This is such a disgrace, even an unlocked bootloader won't save you. Yet another brilliant solution for your "safety" by Google: well, now you're safe, I guess. :/