Will Sandboxed Google Play Make Banking Apps Work on GrapheneOS?
Your bank’s app still refuses to open on GrapheneOS with sandboxed Google Play installed, while about a dozen other banks now allow it. What is your app actually checking?
- Sandboxed Google Play can supply services a banking app needs; it does not change the operating system’s certification.
- GrapheneOS says around a dozen banking apps have started explicitly allowing its OS.
- Check Play services in the app’s profile, crashes and OS integrity rejections as separate issues.
Install Play services in the profile that runs the app
Installing sandboxed Google Play is enough for some banking apps, according to the GrapheneOS usage guide. It addresses a dependency on Google services. Other apps work without it, while some have additional compatibility or OS acceptance requirements.
Profile placement matters. Play services installed in the Owner profile are not automatically available to an app in another user or work profile. The bank app and the services it needs must share a profile.
The official installation route is the GrapheneOS App Store: selecting Google Play services also installs the interdependent Play Store. These run as ordinary sandboxed apps, without the privileged system access Google Play normally receives on stock Android.
A services dependency is different from OS certification
A bank can still reject GrapheneOS after its app finds Play services. The remaining decision may be whether the bank accepts the operating system itself.
Google’s Play Integrity documentation defines MEETS_DEVICE_INTEGRITY in terms of a genuine, certified Android device. On Android 13 and later, it includes hardware-backed evidence of a locked bootloader and a certified manufacturer OS image. The optional basic-integrity verdict has different requirements.
Installing an app cannot turn GrapheneOS into that certified manufacturer image. If the bank requires a verdict the OS does not meet, resolving the Play services dependency leaves the acceptance policy unchanged.
Explicit support is a decision on the bank’s side
In a post dated October 23 UTC, GrapheneOS said around a dozen banking apps had begun explicitly permitting it alongside Google-approved operating systems. The post describes a growing group of apps, rather than a simultaneous rollout across every bank.
The project’s attestation compatibility guide explains a technical route: use Android’s hardware attestation API and accept the official GrapheneOS release signing keys. An app service can verify the hardware, OS and app while accepting a supported alternative OS.
That requires implementation by the app developer. It is a different change from a customer installing Play services, and support for one banking app does not establish support for another.
Separate crashes from integrity rejections
An app that crashes may have a compatibility problem rather than an OS policy block. GrapheneOS explains that its memory protections can expose existing application defects. Its per-app compatibility mode relaxes selected protections; it does not change what a bank trusts.
| Situation | Relevant check |
|---|---|
| The app needs or cannot find Play services. | Check installation within the bank app’s own profile. |
| The app crashes. | Look for an app-specific report and whether compatibility mode is needed. |
| The bank rejects the operating system. | Check the developer’s current GrapheneOS support. |
The compatibility toggle is under Settings → Apps → the app → Exploit protection compatibility mode. It changes protections such as the memory allocator for that app. A failure does not justify starting with device-wide changes.
The PrivSec reporting repository collects app compatibility reports and workarounds from users. Read the app, version and configuration conditions behind a report. Those details are more useful for deciding whether to switch than another customer’s success with an unrelated bank.