microG Services

microG Services, also called GmsCore, is an open-source replacement for Google Play services, the part of Android that apps call for push notifications, location, Google sign-in and maps. It is made by the independent microG project, not by Google, and it’s meant for phones that run without Google’s apps.

It doesn’t install on an ordinary phone that has Google Play services. It uses the same package name as Google’s app, com.google.android.gms, so that apps find it, but it is signed with microG’s key, so Android refuses to install it over Google’s. microG’s wiki puts it plainly: it “cannot be installed on devices that already have Google Play Services installed”.

Which phones it works on

microG needs signature spoofing: the system has to let microG present itself as Google’s app to the apps that call it. microG’s wiki lists ROMs that support it, among them:

• LineageOS, in builds from February 2024, where signature spoofing is “enabled only for microG”. LineageOS checks that the package is “signed with microG release keys”, so only microG’s own signed file works there, this one included; a rebuilt copy doesn’t.
• CalyxOS, /e/OS, iodéOS and LineageOS for microG, which come with microG already installed.
• crDroid, ArrowOS, AospExtended, OmniROM and others listed in the wiki.

Huawei phones running EMUI or HarmonyOS use a separate -hw build, distributed through Huawei AppGallery. It isn’t this file.

What it covers

From microG’s implementation status page, which is older than this version, so take it as approximate:

• Push notifications (Firebase Cloud Messaging): full support. Apps that use it have to be installed after microG.
• Location, including Google’s fused location: full support. You choose an online service for Wi-Fi and mobile-network location; see below.
• Google account sign-in: partial.
• Maps, drawn with Mapbox: mostly works, with minor glitches.
• Security keys and passkeys (FIDO2), Exposure Notifications, SMS code reading, Play Asset Delivery: mostly or fully.
• Play Integrity and SafetyNet: “Mostly” (see the questions above).
• Not intended: analytics, Firebase Analytics and mobile ads.

Its settings include a Self-Check screen that tests whether the system supports signature spoofing, whether microG has it, and whether battery optimisation is off. microG’s setup guide asks you to turn battery optimisation off for it, as “it is required to keep a stable background connection”.

What goes online

When you install it yourself, every Google service in it starts off: device registration, push messaging, device attestation and the Play Store services. A ROM that ships microG can set different defaults; reading them from the system partition is new in this version. Once you turn services on, microG’s wiki lists the Google servers each one uses, and adds: “For all of them, we strip device identifier (MAC addresses, IMEI, etc) from requests where they normally would be (and if required use random but valid identifiers instead).”

• Device attestation, when turned on, downloads and runs Google’s own proprietary DroidGuard code, which Google’s servers require for SafetyNet answers.
• Location: Mozilla’s location service, which microG used to rely on, closed to outside apps in 2024. Since version 0.3.3, “no service selected by default”: no online lookup happens until you choose one. This build offers Positon (marked Suggested), BeaconDB, or your own server. Contributing your Wi-Fi and mobile-network data to BeaconDB is off by default.
• Maps in apps load map tiles from Mapbox, going by the code.
• No update check. microG doesn’t contact its own servers; updates come from its F-Droid repository or a new download. Its F-Droid repository marks every release as connecting to non-free network services, Google’s.

Why our scan lists trackers

Our check reports Google Analytics, Google Firebase Analytics and Google AdMob. microG reimplements Google’s interfaces under Google’s own class names, including empty stand-ins for analytics and ads, and those names match the tracker signatures. microG’s implementation status lists analytics and mobile ads as “Not intended”. We take the match as a consequence of what microG is, not as tracking, though we haven’t traced every one of those classes.

About this file

• This is microG’s own build of version 0.3.17.252432, released on 29 September 2026, from its GitHub release (com.google.android.gms-252432034.apk). It is byte for byte the file in microG’s F-Droid repository, signed with the certificate whose fingerprint microG publishes for that repository (O=NOGAPPS Project).
• 0.3.17 fixes 13 security vulnerabilities, three of them rated high, among them a push-messaging connection that didn’t verify the server’s name. microG says it wasn’t aware of them being exploited.
• A known issue in this version: signing in to Aurora Store for the first time can get stuck because the permission dialog never appears (#3853); a fix is under review.
• The 108.1 MB file runs on Android 4.4 and later and declares 65 permissions, for location, accounts, push messaging, security keys, SMS code reading and the camera for barcode scanning. Some privileged ones only take effect when a ROM grants them; microG says it also works without them, “with only minor downsides”.
• microG is licensed under the Apache-2.0. The source of this version is at https://github.com/microg/GmsCore/tree/v0.3.17.252432.

CPU types in this build: arm64-v8a (64-bit ARM, almost every phone since 2017); armeabi-v7a (32-bit ARM, older and budget phones); x86 (32-bit Intel, emulators); x86_64 (64-bit Intel, emulators and Chromebooks).

Recent releases on the project’s GitHub. We host and check only the newest one. Full changelog.