Loading story…
A technical review details the internal mechanisms of GrapheneOS's hardened malloc, a security-focused memory allocator designed to mitigate memory corruption vulnerabilities. Key features include integration of ARM Memory Tagging Extension (MTE), double quarantine for use-after-free protection, randomized guard pages, and strict metadata isolation. These mechanisms significantly raise the bar for exploitation on GrapheneOS devices compared to standard Android implementations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Bruce Schneier published a post drawing attention to Apple's new memory integrity enforcement mechanism. The post marks public commentary on Apple's memory-safety hardening work, but the underlying Apple change is not dated in the provided content.
Synacktiv published a technical exploration of GrapheneOS's secure allocator, Hardened Malloc, describing its design and security properties. The publication represents a public disclosure of technical details about the allocator's hardening approach.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google Project Zero reported that the first handset with **ARM Memory Tagging Extension (MTE)** reached the market, marking a notable deployment of hardware-backed memory-safety defenses aimed at detecting classes of memory corruption such as use-after-free and out-of-bounds access. The rollout followed Project Zero's earlier implementation testing of MTE, which examined how the feature behaves in practice and highlighted its potential to harden user-space software against exploitation techniques long used in browser and sandbox escapes. Subsequent analysis of MTE in major heap allocators found that the protection materially improves heap-corruption mitigation but leaves important differences in coverage and bypass resistance. Research comparing Chrome's **PartitionAlloc**, **glibc ptmalloc**, and Android's **Scudo** said allocator design choices affect tag randomization, chunk-size coverage, and performance, and noted a previously reported weakness in PartitionAlloc's deterministic tag increment and tag reuse that could let a use-after-free attacker cycle tags to evade checks under some conditions. The findings also said MTE does not fully solve uninitialized memory, stack safety, large shared-buffer protection, or all `mmap`-backed allocation cases, underscoring that the new handset support is a meaningful but incomplete step in reducing memory-corruption risk.
Aug 24, 2026
GrapheneOS warned users not to buy Google's Pixel 11 for its hardened Android distribution and said it may abandon its incomplete Android 17 port after finding no ARM Memory Tagging Extension (MTE) support in the device's software or firmware. The project believes MTE is also likely absent from the hardware; the feature uses tagged memory allocations to detect invalid accesses and materially complicate exploitation of memory-corruption flaws, including remote and local attacks. GrapheneOS has used MTE extensively across its base OS, kernel, and standard system processes since the Pixel 8, and considers its removal a significant security regression. While Pixel 11 reportedly adds ML-DSA post-quantum verified boot, AOSP IMS, and improved Titan M3 protections before first unlock, GrapheneOS said these controls do not compensate for missing MTE. It recommends Pixel 8, Pixel 9, or Pixel 10 models for GrapheneOS deployments and may place greater emphasis on future Motorola devices through its partnership.
Sep 1, 2026
Security researchers and hardening vendors published a connected body of work showing how Linux kernel heap vulnerabilities can be turned into reliable exploitation primitives and how newer allocator-focused defenses aim to break those chains. Public research revisited `CVE-2021-26708`, including Alexander Popov's write-up on exploiting the bug and a later proof of concept demonstrating compromise through `sshd`, while additional analysis examined the `msg_msg` technique for kernel heap reconnaissance and the broader exploitation value of slab allocator behavior. Follow-on defensive work focused on disrupting those memory-unsafety paths at the allocator level. grsecurity described **AUTOSLAB** as a change to the kernel heap security model, HardenedVault assessed **SLUBStick** risk for embedded systems, and later discussed **VED** and post-`CFI` data-oriented protections intended to reduce exploit reliability even when control-flow defenses are present. Together, the reports show a shift from documenting practical Linux kernel heap exploitation to deploying mitigations that target heap grooming, object reuse, and data-only attack techniques.
Aug 17, 2026