There’s no GrapheneOS for Pixel 11 phones because Google cut a key security feature

GrapheneOS is the best custom ROM if you want a secure, private experience. Unfortunately, Google recently made it harder for developers to build custom ROMs for Pixel phones. Now, it turns out that the Pixel 11 phones might not get GrapheneOS at all due to a missing security feature.

The GrapheneOS team announced on Mastodon that they were unable to complete GrapheneOS for Google Pixel 11 phones:

We have a partial port of GrapheneOS to the Pixel 11 series after a week of work on it. We’re unable to complete the port due to lack of support for ARM hardware memory tagging in software, firmware and near certainly hardware. It appears Google cut an important security feature to save money.

This would be a major security omission for Pixel phones if true. The Pixel 8 series shipped with support for Arm’s memory tagging extensions (MTE) back in 2023, and every Pixel phone since then has included the feature. This opt-in feature protects against memory-safety bugs, which can compromise the security of your device. In fact, Google revealed back in 2022 that memory-safety bugs accounted for over 60% of “high severity” security vulnerabilities.

MTE comes with the drawback of slower device performance, though, while some apps don’t support it. It’s perhaps for these reasons that MTE was an opt-in feature on older Pixel phones. This security feature was also enabled when you turned on Android’s Advanced Protection Mode.

Don’t buy a Pixel 11 phone if you want GrapheneOS

The GrapheneOS team explained that they used MTE “across the entire base OS” and only temporarily disabled it for select device-specific processes. In addition to automatically using it for the OS and many apps, the custom ROM also has a per-app toggle so you can opt out if you encounter an incompatible app.

The team strongly suggests that you shouldn’t hold your breath for GrapheneOS to come to the Pixel 11 series down the line:

We haven’t determined what to do about this situation. It may be best for us to skip the Pixel 11 series devices. We can shift our focus entirely to the upcoming Motorola devices instead.

In fact, the GrapheneOS developers added that they “strongly recommend against buying Pixel 11 devices,” as the Pixel 8, Pixel 9, and Pixel 10 phones offer better security for running the custom ROM. However, they are hopeful that the Pixel 11a might include MTE if it has more in common with the Pixel 10 generation. In saying so, leaked Pixel 11a specs suggest it could use the Pixel 11’s chipset.

Furthermore, the team acknowledges that the Pixel 11 series packs some notable security upgrades. This includes post-quantum secure verified boot, the switch from Samsung IMS to AOSP IMS (IP multimedia subsystem), and the Titan M3 chip. Nevertheless, these improvements evidently aren’t enough to enable GrapheneOS on Pixel 11 phones. We’ve asked Google to confirm whether the Pixel 11 phones support MTE and will update the article if/when the company provides an answer.