GrapheneOS may skip Pixel 11 after Google dropped memory tagging
After a week of porting, GrapheneOS stopped work on Pixel 11 because ARM memory tagging is missing in software, firmware and, it says, almost certainly hardware.
A week was enough for GrapheneOS to get a partial Pixel 11 port running. It was not enough to finish one. The project stopped because the new phones would not give it ARM's Memory Tagging Extension in software, in firmware, or, the developers wrote, "near certainly" in the hardware.
On 29 August the team put the finding on Mastodon. "It appears Google cut an important security feature to save money." Google has not answered that charge. Android Authority asked. The company had not replied when that report went up.
The feature Pixel 8 made ordinary, then Pixel 11 dropped
MTE is not an app. It is a silicon trick. Memory locations get a small random tag. A later access has to present the matching tag, or the chip treats it as a memory-safety violation and can kill the process before an exploit finishes. Buffer overflows and use-after-free bugs, the boring majority of serious Android holes, are the target.
Google shipped the first handset with MTE on the Pixel 8 in October 2023. GrapheneOS wired it into hardened_malloc the same month and then ran it across the base system, kernel included, switching it off only for a handful of device-specific processes. Stock Pixel Android never turned it on by default. Android 16's Advanced Protection Mode lights it up for a few processes. GrapheneOS turns it on for far more of the OS and offers a per-app toggle so a broken title can opt out.
That is why the missing piece is not a nice-to-have. GrapheneOS lists hardware memory tagging among the requirements for any phone it will support. Privacy Guides notes Google's own figures that memory-safety bugs have made up around 76 percent of Android vulnerabilities at one point. Android Authority cites Google's 2022 statement that they accounted for more than 60 percent of high-severity issues. Apple now ships an always-on version, Memory Integrity Enforcement, on the iPhone 17. GrapheneOS called that "simply a high quality implementation of MTE" and said Apple "did a very good job integrating it."
The Pixel 11 series is the first Pixel generation since the 8 to show up without usable MTE. Because the feature lives in the chip, a later firmware drop cannot invent the blocks if they are not on the die. GrapheneOS stopped short of a teardown proof. "Near certainly hardware" is the phrase they chose, after finding no support in software or firmware either.
Pixel 11 is not an empty security phone
The same GrapheneOS thread listed the upgrades that did land. Pixel 11 moves verified boot to post-quantum ML-DSA. It replaces Samsung's Shannon IMS with AOSP IMS. The new Titan M3 secure element should, they wrote, "significantly improve protection against data extraction in Before First Unlock state." Then the next sentence: "It's too bad they ruined it by cutting MTE."
That split is the whole argument. Before First Unlock is the locked, powered-off-or-just-booted phone. After First Unlock is the phone in your pocket, decrypted, running apps. GrapheneOS's line is that Titan M3 helps the first state and that losing MTE "craters AFU security." A strong passphrase plus the project's two-factor fingerprint unlock reduces how much you lean on the secure element for encryption. MTE is the mitigation that still matters once the device is in daily use.
Heise also recorded the wider change around Pixel as an AOSP reference device. Pixel support left AOSP with Android 16. Driver binaries and full kernel history are harder to get. GrapheneOS already ships AOSP and kernel patches earlier than stock, but it still depends on Google for firmware. The Motorola partnership is meant to replace that dependency with official access. The first GrapheneOS Motorola will be the successor to the 2026 Motorola Signature, running the generation of Qualcomm silicon after the Snapdragon 8 Elite Gen 5 — a chip the project notes finally has MTE. The 2026 Signature, its original candidate, did not, which is part of why it slipped.
If you bought a Pixel 11 for GrapheneOS
"We strongly recommend against buying Pixel 11 devices," the project wrote. "Pixel 8, 9 and 10 have much better overall security for GrapheneOS. Pixel 10 is cheaper with similar hardware and MTE." A used Pixel 8a, they told one reader, is "nearly as secure as a Pixel 10 and more secure overall than a Pixel 11," and still has years left on Google's seven-year clock. They are hoping the Pixel 11a repeats the 10a trick of using last year's silicon, which would bring MTE back on a cheaper model. That is a hope, not a spec sheet.
An incomplete port can, they said, be made to boot. It would run without MTE, as Pixel 6 and 7 GrapheneOS builds did. They do not want to sell that as the current product. "Not having MTE is a huge security downgrade for GrapheneOS. We aren't sure what to do about it." Skipping the generation and spending the year on Motorola is the option they keep repeating.
None of this is a verdict on Pixel 11 as a camera phone, or on stock Android 17. GrapheneOS is a small, noisy, unusually strict customer. Google can ignore it. Buyers who were about to pay Pixel money specifically to flash GrapheneOS should not. Return the 11 if the window is still open. Keep a 10. Wait for the Motorola. Do not install a partial port and tell yourself it is the same OS you had on a Pixel 9.