GrapheneOS

GrapheneOS's entire design philosophy centers on genuine security engineering rather than just removing Google services: it ships real kernel and userspace hardening (a hardened memory allocator, exploit-mitigation patches upstreamed from the grsecurity/PaX lineage of ideas, a sandboxed Google Play Compatibility Layer that lets Play Services run in a restricted sandbox instead of with full system privileges), and deliberately limits itself to Pixel hardware specifically because Pixels are the only Android devices with fully open-source bootloaders and the verified-boot chain GrapheneOS needs to guarantee its own integrity. It's the option security professionals and journalists in high-risk environments most commonly recommend, ahead of ROMs that prioritize convenience or wider device support over that specific security posture.