GrapheneOS: Pixel 11 drops hardware memory tagging (MTE)

The GrapheneOS project says it has built a partial port of its hardened Android distribution to the Pixel 11 series after a week of work, but cannot finish it because the phones lack support for ARM hardware memory tagging (MTE). In a post published on 29 August, the project said support is missing in software and firmware and "near certainly hardware", adding that Google appears to have cut an important security feature to save money.

What MTE protects against

According to GrapheneOS, MTE is used across its entire base OS, including the kernel and every standard base OS process, and is only temporarily disabled for a few device-specific processes. It greatly improves protection against nearly all remote exploits and many local exploits. The Pixel 8 launched with hardware MTE support in October 2023; GrapheneOS integrated it into hardened_malloc and began using it across the OS later that month. Android and the Pixel OS never started using it by default, while Android Advanced Protection Mode in Android 16 enables it for only a few processes.

Apple's implementation and app opt-in

Apple's Memory Integrity Enforcement (MIE) is an always-enabled feature on the iPhone 17. The project describes it as a high-quality implementation of MTE using the latest standard extensions, used in the kernel's most secure mode and for a large portion of userspace. Neither Apple's MIE nor Android 16+ AAPM use MTE for user-installed apps unless those apps explicitly opt in. GrapheneOS enables it for more apps automatically and provides a per-app toggle, including an opt-out for incompatible apps. The project notes that neither iOS nor Android encourages developers to opt in; Apple's documentation warns of performance and stability issues, and even Signal does not opt in.

What the Pixel 11 gets, and what it costs

The Pixel 11 does bring improvements: a move to post-quantum secure verified boot (ML-DSA), AOSP IMS replacing Samsung's Shannon IMS, and Titan M3, which should significantly improve protection against data extraction in the Before First Unlock state. Even so, the project calls the phones overpriced: more expensive for an incremental CPU improvement, the same underpowered GPU and reduced RAM on the Pro base models, while finally matching the previous generation of Qualcomm's cellular radio. By comparison, a Snapdragon 8 Elite Gen 5 offers roughly 40% higher single-threaded CPU performance, about 80% higher multi-threaded performance and more than double the GPU performance, together with a far better radio and MTE support; that next generation is what will ship in the first Motorola device with GrapheneOS. The project adds that Pixel support was removed from AOSP with Android 16, which now makes Pixels harder to support than many other devices.