First handset with MTE on the market
Summary: Google Project Zero's Mark Brand reports that the Pixel 8 and Pixel 8 Pro are the first production handsets allowing ARM Memory Tagging Extensions to be enabled, a feature he had waited for since late 2017. Using adb commands on a stock image, he set MTE to synchronous mode for apps and native binaries, and a test app with a deliberate use-after-free crashed with a synchronous MTE tag check failure (SEGV_MTESERR).
Bottom line: MTE catches memory corruption at the first dangerous access, and Brand argues that many zero-click attack surfaces - WebRTC calling, media and image parsing libraries - are large amounts of unsafe C/C++ code, so the first production device running almost all user-mode apps with synchronous MTE is a concrete step toward making 0-day harder.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026