GrapheneOS, the hardened Android fork used by roughly 400,000 privacy-conscious users, announced Friday that it has completed only a partial port to Google's newly launched Pixel 11 series — and cannot finish the job. The reason is a hardware decision buried inside the Tensor G6 chip: Google removed ARM Memory Tagging Extension (MTE), a silicon-level security mechanism that GrapheneOS treats as a non-negotiable requirement for any device it will support. The Pixel 11 is the first Pixel generation in three years to lack the feature, and because MTE requires physical hardware blocks on the chip die, no software update or firmware patch can restore it.

"We have a partial port of GrapheneOS to the Pixel 11 series after a week of work on it," the project wrote on Bluesky on August 29. "We're unable to complete the port due to lack of support for ARM hardware memory tagging in software, firmware and near certainly hardware. It appears Google cut an important security feature to save money."

The disclosure lands 18 days after Google unveiled the Pixel 11 lineup — featuring the new Tensor G6 chip, a Titan M3 secure element with quantum-safe secure boot, and roughly a $100 price increase over last year's models — and immediately raises doubts about whether future Pixel devices will remain viable for GrapheneOS at all.

What MTE Is, and Why Hardware Blocks Matter

ARM Memory Tagging Extension is a hardware security mechanism built into chips that implement the ARMv8.5-A instruction set or later. The mechanism works by assigning a small random 4-bit tag to each allocated 16-byte region of memory. Every time the processor reads from or writes to that region, it checks whether the pointer's tag matches the one stored in hardware-protected tag storage. If they do not match — because a buffer has been overflowed, or memory is being accessed after it was freed — the chip raises a fault immediately, stopping the exploit before any malicious payload can execute. ARM's own documentation explains how MTE uses a lock-and-key model to catch both spatial and temporal memory safety violations deterministically, as the ARM Newsroom describes.

This class of memory corruption vulnerabilities — buffer overflows and use-after-free bugs — historically accounted for around 76% of Android vulnerabilities, according to Google's own security research. Software-only mitigations like address space layout randomization (ASLR) and stack canaries provide probabilistic defense; they can be bypassed with enough effort. MTE operating in synchronous mode provides a deterministic catch: either the tags match or the program stops.

For GrapheneOS, MTE is not optional. The project's published device requirements make hardware memory tagging a mandatory qualification, and Google's Pixel 8 and later were the first MTE-capable handsets — the first production handset worldwide to ship the feature, as Google's own Project Zero team documented in November 2023. GrapheneOS deployed MTE on the Pixel 8 about a month after that launch, applying it to the kernel and nearly the entire base OS. In March 2024, the deployment paid off: GrapheneOS's MTE protection uncovered a previously unknown high-severity Bluetooth vulnerability in Android itself — CVE-2024-23694 — a real-world demonstration that the feature surfaces bugs that would otherwise lurk undetected in shipping code.

A critical technical detail that makes the Pixel 11's situation irreversible: MTE is listed as optional even within the ARMv9 instruction set architecture. Chip designers implementing ARM's Cortex cores — including Google's custom Tensor design — can choose not to include the MTE hardware circuits during silicon design. GrapheneOS described the problem as extending into "software, firmware and near certainly hardware," which means the hardware blocks are absent from the Tensor G6 die. No software patch can synthesize hardware that was not manufactured into the chip.

What Changed in the Tensor G6

Several Tensor G6 design choices suggest Google made cost-optimization decisions throughout the chip. The fabrication node is TSMC 3nm — not the 2nm that pre-launch leaks widely reported and that Google initially did not correct. The CPU cluster is seven cores rather than the Tensor G5's eight, with Google trimming one C1-Pro core; Google acknowledged this freed up silicon area for the larger TPU. The GPU is an Imagination PowerVR CXTP-48-1536, a modified derivative of a 2021 flagship design, rather than a current-generation part.

Taken together, these choices describe a chip where die area was repeatedly traded for other priorities — primarily AI compute in the form of the enlarged TPU. The MTE omission is consistent with that pattern. ARM C1 cores support MTE at the ISA level, but implementing the hardware blocks that make the feature function requires dedicated die space: parallel tag storage for each memory granule, modified load/store pipelines with tag-checking logic, and fault injection circuitry. Absent those circuits, MTE cannot be enabled — not now, not after a firmware update, not ever on this generation.

The Pixel 11 does carry genuine security advances in other areas. Its Titan M3 secure element introduces quantum-safe secure boot — using post-quantum cryptography algorithms aligned with NIST standards — a meaningful step forward in hardware attestation against future cryptographic threats, as Privacy Guides detailed at launch. But Titan M3 and MTE address completely different attack surfaces: the secure element handles key storage, boot verification, and rate-limited unlock enforcement; MTE handles runtime memory corruption in the main processor. Upgrading one while removing the other is not a security wash. It is an upgrade to one protection and a downgrade to another.

Apple moved in the opposite direction simultaneously. The iPhone 17, released September 2025, ships with Apple's own MTE implementation — called Memory Integrity Enforcement — built on ARM's Enhanced Memory Tagging Extension and enabled always-on for the kernel and over 70 userland processes, per Apple's security team. That contrast has not been lost on the security community: the company that pioneered consumer MTE adoption has now removed it from its newest device, while a direct competitor ships a more comprehensive implementation by default.

Does Google's New Modem Change the Baseband Picture?

The Tensor G6 introduces one significant hardware departure from prior Pixel design: the modem. Google has replaced the Samsung Exynos modem IP it used through the Pixel 10 series with a MediaTek M90 modem. The Exynos-based modem design historically involved shared memory regions accessible between the modem and application processor domains — a larger baseband attack surface that the prior TechTimes analysis of Snapdragon's radio isolation architecture identified as a structural weakness relative to Qualcomm's separate DSP design.

What the MediaTek M90's isolation architecture looks like in practice has not been independently verified yet. If the M90 provides better physical separation between the modem and the application processor, the Pixel 11 may represent a partial improvement in baseband attack resilience. But that improvement would operate in parallel with — not in place of — the MTE gap. A well-isolated modem reduces the threat of a compromised baseband pivoting to application data; MTE protects the application processor from memory-corruption exploits regardless of how those exploits arrive. Both matter, and the removal of MTE is not offset by a better modem.

The Pixel Relationship, Strained

For GrapheneOS's entire consumer-facing history, Google Pixel devices have been the only Android hardware it supports — not as an ideological choice but as a practical one. Only Pixels have consistently met all of the project's firmware, driver, and hardware security requirements. MTE, available starting with the Pixel 8 in 2023, was central to that alignment.

The relationship grew more complicated before the Pixel 11 launch. In mid-2025, Google stopped publishing open-source userspace driver library code for Pixel devices — code GrapheneOS's integration work had historically relied on. The GrapheneOS Foundation stated directly that this decision is what prompted Motorola to approach the project, leading to the hardware partnership announced at MWC Barcelona in March.

GrapheneOS has now used notably cautious language about its future relationship with the Pixel line. In a Mastodon post from August 2025 — before the Pixel 11 was announced — GrapheneOS stated on Mastodon that it would not depend on future Pixels continuing to provide alternate OS support. That hedge has now become concrete: the Pixel 11's MTE absence is precisely the hardware requirement failure the statement anticipated.

The Motorola Exit Ramp — and Its Timing

The partnership with Motorola points toward GrapheneOS devices running on future Qualcomm Snapdragon hardware. The anticipated platform is Qualcomm's next-generation flagship Snapdragon SoC, which is expected to debut at Snapdragon Summit, scheduled for September 22–24, with commercial devices expected in 2027. GrapheneOS has confirmed that initial Motorola support will land on a standard non-folding flagship before expanding to foldable form factors.

For the threat model of users who run GrapheneOS — journalists, activists, security researchers, and anyone facing sophisticated adversaries — Snapdragon hardware carries a structural radio-isolation advantage. The cellular modem on a Snapdragon device runs in a physically separate memory domain from the main application processor, via the Qualcomm Hexagon DSP and QuRT real-time OS. A compromised baseband cannot easily pivot to application-layer data. That isolation advantage is expected to combine with mature MTE support in the next-generation chip, per the GrapheneOS Foundation's Mastodon, potentially producing a device that GrapheneOS believes will offer better remote attack defenses than any current Pixel.

All forthcoming Motorola devices in scope are expected to carry seven years of firmware, driver, and hardware abstraction layer (HAL) updates — matching the update commitment GrapheneOS currently requires from Google.

But none of this hardware exists yet. For now, GrapheneOS advises users to stick with Pixel 8, 9, and 10 series devices, all of which retain MTE and continue to receive full GrapheneOS support.

What GrapheneOS Users Should Do Now

The practical guidance is specific: do not buy a Pixel 11 if GrapheneOS support matters. The port is incomplete and cannot be made complete in a form that meets the project's security guarantees, because the required hardware is not present in the chip.

GrapheneOS's language about the Pixel 11 stops short of a permanent break with the Pixel line — the project has said it is "not sure if we'll add support for newly launched Pixels afterwards," as PiunikaWeb reported in January — but the phrasing signals that the Pixel 11 generation may be skipped entirely. A device that cannot be ported to GrapheneOS's security standard is not a supported device, regardless of whether an incomplete build is technically installable.

For existing GrapheneOS users on Pixel 8, 9, or 10 hardware, nothing changes today. Those devices remain fully supported. The Pixel 8 series has a support window through October 2030; the Pixel 9 and 10 series run through 2031 and 2032 respectively. The project's update infrastructure continues operating normally on all hardware that meets its requirements.

For anyone shopping for a new device with GrapheneOS in mind, the advice is to wait — either for a resolution on the Pixel 11 or Pixel 12 that restores MTE, or for the first Motorola flagship meeting GrapheneOS's full hardware requirements in 2027.

A Hardware Decision With Ecosystem Consequences

The Pixel 11 situation is not simply a technical incompatibility between one OS project and one phone. It marks the first time since GrapheneOS became a mainstream privacy tool that Google's own hardware has failed to meet the project's requirements — and it happened on the same chip generation where Google added quantum-safe secure boot via Titan M3, upgraded the CPU architecture, switched modem vendors, and raised the price. Google pioneered consumer MTE adoption, being the first manufacturer to ship it in a retail smartphone. It has now removed it without explanation.

For the broader ecosystem of hardened mobile software that treats GrapheneOS as a reference implementation, the Pixel 11 launch is a setback that will only resolve when either Google restores MTE in the Pixel 12, or the 2027 Motorola hardware arrives and creates a production alternative. Both timelines are at least a year away.

Frequently Asked Questions

Does GrapheneOS work on the Pixel 11?

Not in a form that meets GrapheneOS's security requirements. The project completed a partial port to the Pixel 11 series in about a week of work but confirmed on August 29, 2026 that it cannot finish the port because the Pixel 11's Tensor G6 chip lacks the ARM Memory Tagging Extension hardware blocks that GrapheneOS requires for production deployment. An incomplete port is technically installable but does not provide the memory-safety protection that GrapheneOS is built around. GrapheneOS has said it may skip the Pixel 11 generation entirely.

What phones support GrapheneOS right now in 2026?

The Pixel 8, Pixel 8 Pro, Pixel 8a, Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 10, and Pixel 10 Pro series all carry hardware MTE and remain fully supported with regular updates. The Pixel 11 series currently does not meet GrapheneOS's hardware requirements due to the MTE absence. No Motorola device yet qualifies; the first Motorola devices meeting GrapheneOS's full requirements are expected in 2027 on next-generation Snapdragon hardware.

Why can't Google just add MTE back through a software or firmware update?

MTE requires dedicated physical hardware circuits on the chip: tag storage memory for every 16-byte memory granule, modified load/store pipelines with tag-checking logic, and fault-injection circuitry. These are silicon structures that either exist in the manufactured chip or do not. GrapheneOS's announcement confirmed the absence extends through software, firmware, and "near certainly hardware" — meaning the circuits were not built into the Tensor G6 die during fabrication at TSMC. A future software or firmware update cannot add circuits to a chip that was already manufactured without them.

What is Apple doing differently on the iPhone 17?

Apple shipped Memory Integrity Enforcement on the iPhone 17 and iPhone Air — an always-on, comprehensive implementation built on ARM's Enhanced Memory Tagging Extension (EMTE) that covers the kernel and over 70 userland processes. Apple worked directly with ARM to develop the Enhanced version of the specification, which adds tag confidentiality enforcement to address side-channel tag-leakage attacks. Where Google removed hardware memory tagging from its 2026 flagship, Apple made it a standard, always-enabled feature on every new iPhone shipped in 2025.