PayPal Stopped Launching on GrapheneOS Because of a False Security Positive

A GrapheneOS user going by the handle leumon reported on Hacker News that the PayPal mobile app refuses to run on his smartphone. On launch it crashes with a RootDetectionSecurityException and a message about a “security policy violation: root.” In other words, the app's protection mechanism decided the device had been compromised.

The paradox is that GrapheneOS is a privacy- and security-focused fork of Android that by default grants no root access whatsoever: it runs with a locked bootloader, verified boot and, unlike microG builds, uses the real Google Play services. So the “tampering” detector fired on a system that is objectively better protected than many stock firmwares.

Not a ban, but a false alarm

Judging by the discussion, the loud headline “PayPal blocks GrapheneOS” is misleading. Developers familiar with RASP technology (runtime application self-protection) note that such checks often rely on indirect signals — for example, attempts at dynamic code loading. It appears that GrapheneOS's very own hardened protection features triggered the false positive.

This is borne out in practice, too: some users never ran into the problem at all, and the thread's author himself quickly found a workaround. It's enough to turn off the “Secure app spawning” option — or to enable the exploit-protection compatibility mode, allowing dynamic code loading. After that the app works again. There is a theory that the failure is tied to a recent PayPal update and a new check, which will either be refined by the service itself or worked around by the GrapheneOS team.

A familiar story

The discussion quickly moved beyond the specific error. Participants recalled a long-standing grievance with financial apps: why is firmware that is several years out of date, with dozens of unpatched vulnerabilities, considered “trusted,” while a fresh system with daily updates is not? A reasonable counterargument was also voiced: PayPal has its own threat perimeter, and for a large payment service it is simpler to block everything it cannot reliably verify than to sort out every niche case.

Users separately note: it will be interesting to see whether app makers change their attitude toward GrapheneOS once Motorola starts shipping smartphones with the system out of the box. For now, the practical advice for anyone hitting the crash is simple — adjust the exploit-protection settings, or use the web version of PayPal, which continues to work.

Source: Hacker News