GrapheneOS may drop Pixel 11 over a missing chip-level memory-safety feature

GrapheneOS, the privacy-focused alternative Android operating system, currently tells users who want its full security stack to buy a Pixel 8, 9, or 10. The Pixel 11, the project now says, ships with a memory-safety feature it has relied on since 2023 in too broken a state to use, and supporting the new device would mean shipping a less secure phone than the one it already supports.

The feature is ARM Memory Tagging Extension, or MTE. MTE is a hardware feature built into a phone's main processor that tags every block of memory with a small color code and checks the tag whenever the chip reads or writes that block. If a memory-corruption bug tries to touch the wrong region, the hardware catches the mismatch and the operating system can kill the offending process before it becomes a foothold. The Pixel 8 was the first Android phone to ship with MTE hardware in October 2023, and GrapheneOS has wired the feature into the kernel, its hardened memory allocator, and standard system processes since then.

GrapheneOS's first public posts framed the issue as MTE being "near certainly" absent from the Pixel 11's hardware. Later posts corrected that: the new phone does still include at least the bare minimum MTE hardware, but the acceleration that makes the feature usable has been pulled out of the CPU cache. The resulting performance hit was large enough that Google has fully disabled MTE in firmware, leaving the hardware present but inert from the operating system's point of view.

The Pixel 11 is not a step backward on every security front. Google has added a new Titan M3 security chip, post-quantum ML-DSA signatures for verified boot, and a replacement of the Samsung Shannon IMS components with AOSP's reference IMS. GrapheneOS highlights all three, and the Titan M3 in particular is expected to strengthen resistance to data extraction in the "Before First Unlock" state, the short window after a restart before a user enters their PIN.

MTE covers a different attack surface. Once a phone is unlocked and a user is moving through apps, the device is in the "After First Unlock" state, and a memory-corruption bug in a browser, a media library, or a system process becomes a plausible path to remote code execution. MTE is built to catch those bugs at the hardware level, and GrapheneOS argues that the other Pixel 11 security gains do not substitute for what MTE protects. Stock Android on the Pixel has never enabled MTE by default, and Android 16's Advanced Protection Mode turns it on for only a handful of processes, per the project's writeup.

That difference is now a competitive one. Apple has shipped its own variant, Memory Integrity Enforcement, as an always-on feature on the iPhone 17, and GrapheneOS frames that as a higher bar than Google's opt-in approach. On the iPhone side, memory safety is on by default for the whole system; on the Pixel side, only a privacy-focused aftermarket project had made it work in production, and that project now considers the new generation a regression.

Google has not publicly explained the change. GrapheneOS says the company has not explained it to the project either, and that the project's best guess is cost-cutting, with an undisclosed hardware flaw as a second possibility. The project had previously heard from a Google insider that MTE could be removed from a future Pixel generation, which the project cites as context rather than confirmation of motive.

The practical guidance for now is specific. Buyers who want to run GrapheneOS at its normal security bar should pick a Pixel 8, 9, or 10. Buyers who want a Pixel 11 should plan to run stock Android or another aftermarket ROM and accept the memory-safety gap. The project's follow-up also flags that the loss of MTE on the Pixel 11 may accelerate its push beyond Pixel hardware, which would narrow the long-running relationship between the most security-conscious Android distribution and Google's flagship line.