Google’s Pixel 11 Has the Ultimate Security Feature. They Intentionally Turned It Off.

You spend over a thousand dollars on a flagship phone because you expect the best. The best camera, the best screen, and supposedly, the best security. You trust the multi-billion-dollar tech giant to protect your data. But what if they built the ultimate digital safe, installed it on your phone, and then deliberately left the lock disengaged?

That’s exactly what Google just got caught doing with the Pixel 11.

For years, the tech industry has battled memory corruption bugs—the nasty vulnerabilities that let hackers silently hijack your device. Arm finally came up with a hardware-level defense called MTE (Memory Tagging Extension). It’s a game-changer. It stops entire classes of zero-click attacks dead in their tracks. When MTE was rumored for the Pixel line, security researchers and privacy advocates celebrated. Finally, a consumer device taking hardware security seriously.

Then the Pixel 11 shipped. MTE was nowhere to be found. At first, people assumed the silicon just wasn’t there. But the brilliant minds at GrapheneOS tore into the device and made a sickening discovery: the MTE support is absolutely there, fully baked into the silicon.

“Support” on a spec sheet is the oldest con in tech. If it isn’t on by default, it doesn’t exist.

Google built the hardware, but they intentionally disabled it in the shipped product. Why? Because enabling actual security costs a tiny fraction of performance, and apparently, that trade-off wasn’t worth it to them.

Let’s be brutally honest about what this means. Memory safety bugs account for the vast majority of severe vulnerabilities in native code. MTE is the armor that stops them. By disabling it to save a few percentage points of benchmark performance, Google is actively choosing to leave you exposed to zero-day exploits.

They want the marketing claim of having cutting-edge security architecture, without the burden of actually deploying it. It’s the equivalent of a car manufacturer installing military-grade armor plating, but leaving the bolts loose because tightening them might lower your fuel efficiency.

When security becomes a line item on a cost-benefit analysis, you stop being a customer and start becoming an acceptable risk.

This isn’t some scrappy startup trying to scrape by on margins. This is Alphabet, a company raking in billions of dollars in profit every single quarter. And yet, they looked at their flagship device—the very pinnacle of their engineering prowess—and decided that your protection wasn’t worth the performance hit. Apple is reportedly bringing similar memory protections to the iPhone 17. Google’s work in this space is apparently done—not by finishing it, but by abandoning it.

The old Google, the one that actually gave a damn about software and the end-user, is dead. This new Google sells you the illusion of security. They hand you a beautiful, glossy box, tell you it’s fortified, and hope you never realize the drawbridge is permanently down.

They forged the armor. They just decided not to let you wear it.

If you buy a Pixel 11, you are buying a device capable of defending itself against some of the most devastating attacks on the internet. But you will never get that defense. You will remain exposed, all because a trillion-dollar company wanted to save a fraction of a cent on performance overhead. Next time you see a tech giant bragging about their security, don’t look at the marketing. Look at the default settings.