MTE As Implemented, Part 2: Mitigation Case Studies
Summary: Google Project Zero's Mark Brand assessed how well ARM's Memory Tagging Extensions (MTE), proposed by ARM in 2018 in the v8.5a architecture, hold up as a mitigation across four usermode contexts: the Chrome renderer, Chrome IPC sandbox escape, Android Binder sandbox escape, and Android messaging apps. He concludes that Spectre-type speculative side-channels can break tag confidentiality, making known-tag bypasses a certainty, and that async-MTE is insufficient for a hard mitigation, so at least sync-MTE is needed.
What you should know: Project Zero assumes a high-tier attacker wants roughly 95% exploit reliability, and its table rates known-tag bypasses as trivial in the Chrome renderer under async-MTE and likely possible in many cases for Chrome IPC and Android Binder sandbox escapes. The mitigation still raises attacker cost and detection risk, but the bypass techniques are generic and shareable across exploits once developed.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026