Google's Android Red Team partnered with Arm to conduct a security analysis of the Mali GPU, a component used in billions of Android devices worldwide. The goal of this collaboration was to identify and fix vulnerabilities in the GPU software and firmware stack. The Mali GPU has become a critical target for attackers due to its complexity and privileged access to the system, with the majority of Android kernel driver-based exploits targeting the GPU since 2021. To improve security, the team focused on reducing the driver's attack surface by restricting access to certain GPU IOCTLs. The team used SELinux to harden the GPU by blocking access to deprecated and debug IOCTLs in production, while allowing access to instrumentation IOCTLs only for debugging tools. The approach was rolled out in stages, starting with an "opt-in" policy and moving to an "opt-out" policy, to minimize the impact on developers. The team also provided step-by-step instructions on how to implement a robust SELinux policy to filter GPU ioctls. The core principle is to create a flexible, platform-level macro that allows each device to define its own specific lists of GPU ioctl commands to be restricted. The Android security team is committed to collaborating with ecosystem partners to drive broader adoption of this approach to help harden the GPU. By reducing the attack surface, this approach provides strong protection against existing and future vulnerabilities, and the team is working to raise the bar on GPU security to ensure the Mali GPU driver and firmware remain highly resilient against potential threats. The partnership with Arm and the use of SELinux have been crucial in achieving this goal, and the team is committed to continuing this effort to improve the security of Android devices.