Both patches in the November 2025 Android Security Bulletin have been included since our September 2nd release. It's now known that our 2025090200 and later releases provided the 2025-11-05 Android security patch level early due to shipping extra patches.
https://source.android.com/docs/security/bulletin/2025-11-01
It's because these two patches were included in the full September 2025 bulletin patches we shipped but were made optional until November 2025.
Later in September, we started our security preview releases able to provide Android Security Bulletin patches around 2-3 months early.
Our security preview releases currently have the December 2025 and January 2026 patches.
December 2025 has a huge set of patches due to being a quarterly patch level. January 2026 will likely be empty.
We should have quarterly March 2026 patches to ship within a couple weeks.
Due to having early access to the patches which we can use for our security preview releases, we've been able to determine that a subset were pushed to AOSP and other projects prior to the official embargo ending which means we'll be including those in our regular releases soon.
Our security preview releases shipped all available December 2025 security patches in September 2025 and have continued adding the remaining patches. It should be frozen soon, but most of the patches have remained the same since September. Some were deferred to future bulletins.
The new security patch system being used by Android is confusing for users and bad for the security of anyone not using GrapheneOS with our security preview releases. We could have set the patch level string to 2025-11-01 in early September but in this case we didn't do that.