Block 911 from overriding airplane mode?

keycap_puller

The emergency call feature on the lock screen legitimately bypasses airplane mode. Dialing 911 will automatically disable airplane mode without requiring a password or fingerprint to unlock the device. This behavior could potentially be exploited by a threat actor who gains physical access to the phone, as it expands the attack surface by activating the GSM module. Should GrapheneOS consider adding a toggle to disable this behavior?

MetropleX

keycap_puller no and this doesn't work like you think it does, it is baked into the standard and works regardless of SIM presence in the device.

https://source.android.com/docs/core/connect/emergency-call

The radio is a fully isolated component and uses solely cellular based technology to function for Emergency Call use.

Please see the references in the link provided for the legal and regulatory requirements.

keycap_puller

MetropleX
https://source.android.com/docs/security/bulletin/pixel/2026/2026-03-01

CVE-2026-0114 Modem
CVE-2026-0120 Modem
CVE-2026-0122 Baseband
CVE-2026-0110 Modem
CVE-2026-0111 Cellular Modem
CVE-2026-0113 Cellular Modem

If radio is a fully isolated component, why are there vulnerabilities? Does activating airplane mode prevent such exploits? If it does not, then there is no reason to protect airplane mode from unauthorized deactivation.

MetropleX

keycap_puller If radio is a fully isolated component, why are there vulnerabilities

Having vulnerabilities in one component doesn't mean anything for the OS and each exploit will generally need to be chained together with others to make it to the OS level or vice versa. This is the benefit of us having isolated components as a hard line position for our hardware requirements.

Revliss

Some vulnerabilities in the modem have been discovered and Airplane mode should turn it off. If I understood it well, hardware separation means the modem shouldn't have access to your ram and other parts of the system. So even tho, the modem is vulnerable, it can't leak any valuable information. The only way to know is a cheap (30$) RTL-SDR; a software defined radio you hook onto your computer yo check if the device emits anything radio.

keycap_puller

MetropleX Whatever. The key question is not whether a radio module exploit results in kernel-space or user-space compromise, but rather whether the radio module should be protected by a robust airplane mode.

MetropleX

keycap_puller it is, the OS is protected from the radio module through IOMMU.
Covered here: https://grapheneos.org/faq#baseband-isolation

Airplane mode is robust to avoid 911 disabling it, just don't make an emergency call from it. The user controls this, it is not capable of being triggered remotely. If you read the regulatory documentation you'd see this.

You're focused on a hypothetical that doesn't exist.

keycap_puller

MetropleX The user controls this, it is not capable of being triggered remotely

A person with physical access to a device controls this, not just the owner. I never argued about isolation between radio and OS, nor did I mention remote exploitation.

MetropleX

keycap_puller If in possession of it but not your PIN/Password, other than making a call there isn't much they can do, even if they made the call and activated the radio, they would have to have aforementioned exploit chain to then use it somehow to access the OS and your data. The radio in and of itself regardless to vulnerabilities to itself, isn't a direct vector to the OS.

If they have your PIN/Password then the radio is irrelevant anyway and if it isn't in BFU state having a low auto reboot timer will help you get further peace of mind.