The GrapheneOS team has announced that it cannot complete a version of its security-hardened Android ROM for the upcoming Google Pixel 11 series. The reason: Google has reportedly removed a key hardware security feature from the new phones. In a statement posted on Mastodon, the developers explained they were unable to finish the port after a week of work, citing the lack of support for ARM hardware memory tagging (MTE) in software, firmware, and almost certainly hardware. The team suggested Google may have cut the feature to save money.

GrapheneOS hits a wall with Pixel 11

GrapheneOS is widely considered the most secure and private Android-based operating system available. It is a custom ROM that focuses on defense-in-depth, hardening the Android Open Source Project (AOSP) with additional security mechanisms, stricter permissions, and privacy enhancements. For years, the project has maintained close support for Google Pixel devices, largely because Pixels offer strong hardware security foundations and allow bootloader unlocking in a controlled manner. However, the relationship between GrapheneOS and Pixel hardware has now hit a serious obstacle.

According to the GrapheneOS team, the Pixel 11 series lacks support for ARM's memory tagging extensions, or MTE. This hardware feature helps prevent memory-safety attacks by tagging memory allocations and checking those tags whenever memory is accessed. If a program tries to use memory in an invalid way, the tag mismatch triggers a fault, stopping the exploit before it can succeed. MTE is considered a major leap forward in memory safety because it detects common programming errors such as buffer overflows, use-after-free bugs, and other memory corruption issues at runtime, rather than relying solely on software patches.

The team's statement said: "We have a partial port of GrapheneOS to the Pixel 11 series after a week of work on it. We're unable to complete the port due to lack of support for ARM hardware memory tagging in software, firmware and near certainly hardware. It appears Google cut an important security feature to save money." This is a strong accusation, but one that highlights the significance of MTE in modern device security.

What is MTE and why does it matter?

Memory-safety bugs have been a persistent problem in software for decades. These bugs occur when a program accesses memory that it shouldn't, often because of coding mistakes like pointer corruption, out-of-bounds reads or writes, or use-after-free conditions. According to a Google report from 2022, memory-safety bugs accounted for over 60 percent of "high severity" security vulnerabilities across the industry. That statistic has driven the tech industry to look for hardware-level solutions, and ARM's MTE is one of the most promising.

MTE works by assigning a 4-bit tag to every 16-byte memory granule in the system. When a pointer is created, it is also assigned a tag. The hardware checks the tag on every memory access; if the tag on the pointer doesn't match the tag on the memory location, a fault occurs. This can prevent an attacker from successfully exploiting a memory corruption bug, turning what might otherwise be a critical remote code execution vulnerability into a simple crash, or even catching the error during development.

Google first added MTE support to Pixel smartphones with the Pixel 8 series in 2023. Since then, every Pixel generation has included the feature, albeit as an opt-in setting. Users could enable MTE through the developer options or by turning on Android's Advanced Protection Mode, which applies stricter security controls. On older Pixels, enabling MTE was known to cause some performance overhead, and certain apps that were not compatible with memory tagging would fail to run. That is likely why Google chose to keep it off by default.

How GrapheneOS used MTE

GrapheneOS took a different approach. Rather than leaving MTE off by default, the team enabled it across the entire base operating system. The ROM automatically used MTE for the OS itself and for many apps, while temporarily disabling it for specific device-specific processes that had compatibility issues. GrapheneOS also provided a per-app toggle, allowing users to turn off MTE for any application that had trouble running with memory tagging enabled.

This aggressive use of MTE gave GrapheneOS users an unprecedented level of protection against memory-safety vulnerabilities. Because the OS and most apps were built with MTE turned on, any attempt to exploit a memory bug in the kernel, system services, or common applications would likely be caught immediately. The per-app toggle ensured that users did not have to give up functionality; they could simply whitelist problematic apps.

For the GrapheneOS team, MTE is not just a nice extra; it is a foundational piece of the project's security architecture. Without hardware-level support for MTE, the team would have to rely on software-only mitigation techniques, which offer far weaker protection. That is why the lack of MTE on Pixel 11 devices is a dealbreaker.

Why Google may have dropped MTE

The GrapheneOS team's suggestion that Google cut MTE to save money is plausible for several reasons. Adding hardware support for MTE requires additional design and manufacturing complexity in the application processor and memory subsystem. It also requires firmware and software support, all of which add to the overall cost of a device. For a company trying to keep Pixel prices competitive, even a small amount of extra silicon area or engineering time can be a tempting place to cut corners.

Another factor could be performance. MTE, especially when enabled system-wide, has a small but measurable impact on CPU performance and energy consumption. While the overhead is generally modest, it can become more noticeable on mobile devices where every milliwatt matters. Google may have decided that the performance and battery life trade-offs were not worth the security benefits, particularly if the feature is not widely used by consumers.

App compatibility is also a concern. Some applications, especially those with native code or unusual memory allocation patterns, can crash when MTE is enabled. Google already restricted MTE to an opt-in setting on older Pixels for this reason. If the company wanted to avoid customer support issues, it might have decided to abandon MTE altogether rather than continue to offer it as an opt-in feature that some users might accidentally enable.

However, from a security perspective, removing MTE is a clear regression. The Pixel series has been celebrated for its security leadership, and MTE was a key part of that reputation. By dropping it, Google is making the Pixel 11 series less resilient against a major class of vulnerabilities, at a time when memory-safety attacks remain a constant threat.

What Pixel 11 gets instead

It is not all bad news for Pixel 11 security. The GrapheneOS team acknowledged that the Pixel 11 series includes some notable security upgrades. Among them are post-quantum secure verified boot, a switch from Samsung IMS to AOSP IMS (IP multimedia subsystem), and the new Titan M3 security chip. Post-quantum secure verified boot protects against future quantum computers that could break current cryptographic algorithms, while the Titan M3 chip adds hardware-backed key storage and attestation capabilities.

These are meaningful improvements, and they show that Google is still investing in certain areas of security. But the GrapheneOS team is clear that none of these upgrades compensate for the absence of MTE. Without MTE, the device is much more susceptible to memory-safety vulnerabilities, which remain one of the most common attack vectors for Android malware and remote exploits.

The team also noted that they might shift their focus entirely to upcoming Motorola devices. Motorola has been building devices with strong custom ROM support and has shown willingness to work with the GrapheneOS project. In recent months, the GrapheneOS team has been experimenting with Motorola hardware, and those devices apparently include MTE support. If the project does indeed abandon the Pixel 11 lineup, Motorola could become the new primary platform for security-conscious users.

Should you skip Pixel 11?

The GrapheneOS team has "strongly recommended against buying Pixel 11 devices," arguing that the Pixel 8, Pixel 9, and Pixel 10 phones offer better security for running the custom ROM. They did hold out a sliver of hope for the Pixel 11a, saying it might include MTE if it has more in common with the Pixel 10 generation. However, leaked specs suggest the Pixel 11a could use the Pixel 11's chipset, which would likely mean it also lacks MTE.

For users who are not interested in GrapheneOS, the Pixel 11 series may still be an attractive choice. The security upgrades it does offer, such as post-quantum secure verified boot and the Titan M3 chip, provide tangible benefits. And the standard Android experience remains feature-rich, with Google's usual blend of AI-assisted tools, camera improvements, and timely software updates. But for anyone who values custom ROM support or wants the strongest memory-safety protections, the GrapheneOS team's warning is a significant red flag.

The news also raises broader questions about Google's commitment to advanced security features across its hardware lineup. MTE was introduced with great fanfare on the Pixel 8, and Google has repeatedly touted its Pixel devices as the gold standard for Android security. If the company has now removed MTE from the Pixel 11 to save money, that could be seen as a reversal of that commitment. It remains to be seen whether Google will respond to the GrapheneOS team's claims or explain its decision.

At the time of writing, Google has not yet provided an official statement about MTE support on the Pixel 11 series. The GrapheneOS team said they asked Google to confirm the situation, but no answer has been given. Until that response arrives, the security community is left to weigh the evidence and decide whether the Pixel 11 is a device worth buying or skipping.

Source: Android Authority News