Loading story…
Google Project Zero reported that the first handset with ARM Memory Tagging Extension (MTE) reached the market, marking a notable deployment of hardware-backed memory-safety defenses aimed at detecting classes of memory corruption such as use-after-free and out-of-bounds access. The rollout followed Project Zero's earlier implementation testing of MTE, which examined how the feature behaves in practice and highlighted its potential to harden user-space software against exploitation techniques long used in browser and sandbox escapes.
Subsequent analysis of MTE in major heap allocators found that the protection materially improves heap-corruption mitigation but leaves important differences in coverage and bypass resistance. Research comparing Chrome's PartitionAlloc, glibc ptmalloc, and Android's Scudo said allocator design choices affect tag randomization, chunk-size coverage, and performance, and noted a previously reported weakness in PartitionAlloc's deterministic tag increment and tag reuse that could let a use-after-free attacker cycle tags to evade checks under some conditions. The findings also said MTE does not fully solve uninitialized memory, stack safety, large shared-buffer protection, or all mmap-backed allocation cases, underscoring that the new handset support is a meaningful but incomplete step in reducing memory-corruption risk.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
The Google Pixel 8 was identified as the first smartphone released in 2023 to support ARM MTE. This represented the first handset availability of the mitigation discussed in the references.
ARM introduced Memory Tagging Extensions (MTE) as part of the ARMv8.5-A architecture. This established the hardware capability later used by allocators and devices to detect some memory-safety errors.
DarkNavy published an analysis comparing MTE behavior in Chrome's PartitionAlloc, Glibc's Ptmalloc, and Android's Scudo. The article concluded that MTE materially improves heap-corruption mitigation but leaves important gaps and allocator-specific trade-offs.
Researchers reported issues in Chrome PartitionAlloc's MTE implementation to Google, including deterministic tag increment on free and likely tag reuse on allocation that could enable a use-after-free bypass. The Chrome team confirmed the issue, and the article cites Chrome Issue 1512538 for a fuller report and proof of concept.
Google Project Zero published "MTE As Implemented, Part 1: Implementation Testing," analyzing how MTE was implemented and tested in practice. This marked a public technical examination of allocator-level MTE behavior.
Google Project Zero published "Virtually Unlimited Memory: Escaping the Chrome Sandbox," documenting a Chrome sandbox escape based on memory corruption. The reference provides historical context for later MTE-focused mitigation work.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
darknavy.org
Open sourcedarknavy.org
Open sourcegoogleprojectzero.blogspot.com
Open sourcegoogleprojectzero.blogspot.com
Open sourcegoogleprojectzero.blogspot.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GrapheneOS warned users not to buy Google's Pixel 11 for its hardened Android distribution and said it may abandon its incomplete Android 17 port after finding no ARM Memory Tagging Extension (MTE) support in the device's software or firmware. The project believes MTE is also likely absent from the hardware; the feature uses tagged memory allocations to detect invalid accesses and materially complicate exploitation of memory-corruption flaws, including remote and local attacks. GrapheneOS has used MTE extensively across its base OS, kernel, and standard system processes since the Pixel 8, and considers its removal a significant security regression. While Pixel 11 reportedly adds ML-DSA post-quantum verified boot, AOSP IMS, and improved Titan M3 protections before first unlock, GrapheneOS said these controls do not compensate for missing MTE. It recommends Pixel 8, Pixel 9, or Pixel 10 models for GrapheneOS deployments and may place greater emphasis on future Motorola devices through its partnership.
Sep 1, 2026
A technical review details the internal mechanisms of GrapheneOS's hardened malloc, a security-focused memory allocator designed to mitigate memory corruption vulnerabilities. Key features include integration of ARM Memory Tagging Extension (MTE), double quarantine for use-after-free protection, randomized guard pages, and strict metadata isolation. These mechanisms significantly raise the bar for exploitation on GrapheneOS devices compared to standard Android implementations.
Jun 29, 2026
Security researchers and vendors reported **hardware/firmware-level vulnerabilities in Android chip components** that can enable deep device compromise beyond typical app-layer defenses. Ledger’s Donjon research described a flaw involving **MediaTek chip boot-chain behavior and Trustonic’s trusted execution environment (TEE)** that allowed rapid physical compromise: by connecting an affected phone to a laptop over **USB**, attackers could allegedly brute-force the PIN, decrypt storage, and extract sensitive data including messages and **cryptocurrency wallet seed phrases** (e.g., Kraken Wallet, Phantom). The researchers estimated the affected MediaTek chips appear in roughly **one-quarter of Android phones**, disproportionately in lower-cost devices. Separately, Zimperium reported active exploitation of a **Qualcomm graphics zero-day** (**CVE-2026-21385**) in targeted Android attacks, describing a memory-corruption condition that could enable code execution or unauthorized access across “hundreds” of Qualcomm chipsets. A ZDNET article on Android’s *Repair Mode* primarily provides user guidance and anecdotal troubleshooting around a buggy March update/SIM recognition issue; it does not substantively address the chip-level vulnerabilities described in the other reporting and is best treated as tangential consumer advice rather than incident or vulnerability intelligence.
Jun 29, 2026