www.it-connect.fr
Google Pixel 11 Drops MTE Support, and GrapheneOS Says Skip It
Don't buy a Pixel 11. That is the recommendation from the GrapheneOS team after running into a dead end. GrapheneOS was unable to complete the port of its hardened Android build to Google's new lineup. But why?
Does Google want to kill the GrapheneOS project? I would not go that far, especially since GrapheneOS has finalized a partnership with Motorola. However, there is a point of contention between GrapheneOS and Google regarding the latest generation of Pixel smartphones, namely the Pixel 11 lineup. Indeed, the partial port completed on the Pixel 11 cannot go any further: support for hardware memory tagging is missing at the software level, at the firmware level, and almost certainly at the silicon level itself.
"It seems that Google removed an important security feature to save money", writes the GrapheneOS team. For its part, Google has provided no explanation, and this could be an undisclosed hardware defect. GrapheneOS also claims that MTE could disappear from a future Pixel generation: this information would come from an internal source at Google.
What is MTE? In practice, MTE (Memory Tagging Extension) associates a random tag with each allocated memory region. If a program accesses an area whose tag does not match, the hardware detects the anomaly and can stop execution before an exploit succeeds. In other words, it cuts off an entire family of memory corruption vulnerabilities at the source, which is common on Android. In fact, many critical Android flaws are tied to memory corruption... Yet this security mechanism is not old: the Google Pixel 8 in October 2023 was the first to include MTE. GrapheneOS quickly integrated it into its memory allocator, then extended it to the kernel and all system processes.
However, Android and the Pixel OS have never enabled MTE by default. It is enabled sparingly for a few processes. In reality, on mobile, GrapheneOS was therefore the main real-world user of the feature, alongside the equivalent implementation from Apple (Memory Integrity Enforcement), which is always enabled on the iPhone 17.
There Are Still Improvements in the Pixel 11
That said, even though the Pixel 11 has this flaw, it does not arrive empty-handed. GrapheneOS acknowledges three improvements:
- Post-quantum ML-DSA signatures for verified boot
- Replacement of Samsung's proprietary IMS components (Shannon) with the AOSP implementation
- The new Titan M3 security chip
In practice, the Titan M3 chip should improve resistance to data extraction as long as the device has not been unlocked since boot. This refers to the BFU (Before First Unlock) state of a device that has just rebooted. I wrote about this in August in my article about the Dutch forensic institute that managed to unlock a Google Pixel in a criminal case.
The problem is that losing MTE significantly weakens protection in the AFU (After First Unlock) state, meaning during normal everyday use. In other words, security is stronger when the device is off or just after rebooting (and has not yet been unlocked), but much of that protection is lost during regular operation.
Skip the Pixel 11 and Focus on Motorola
For now, GrapheneOS advises against buying a Pixel 11 and points users to the Pixel 8, 9, and 10, which do include MTE. Anyone who bought a Pixel 11 specifically to install GrapheneOS is advised to return it.
GrapheneOS may give up on supporting the Pixel 11 altogether. In practice, skipping this generation would allow the GrapheneOS team to focus its resources on the partnership with Motorola that I mentioned last March, whose future high-end model must meet its hardware requirements, including MTE.
"We have not decided yet how to handle this situation. It may be better for us to set aside the Pixel 11 devices. We could instead focus entirely on upcoming Motorola devices. The Pixel 10a was actually a 9th-generation Pixel; let’s hope the Pixel 11a does the same with the 10th generation and includes MTE technology.", can be read on X.
One question remains: will the Pixel 11a bring back MTE? GrapheneOS hopes so, but nothing official has been announced.
