GrapheneOS Security Updates GrapheneOS handles memory safety and sandboxing on its own. What it does not decide on its own is how much your radios talk, what resolves your DNS, or how long the device stays awake and unlocked.
Domain Naming Service (DNS) A VPN protects what you send. It does not always cover the question you asked first — which site, and where does it live. Whoever answers that lookup decides where your browser actually lands.