Pixel 8 providing hardware memory tagging support is a massive security advance for GrapheneOS. This hardware feature only helps if the OS uses it like GrapheneOS, and the security it provides entirely depends on how it's used. We have a great implementation in hardened_malloc.
GrapheneOS on the Pixel 8 and Pixel 8 Pro is the first platform with this feature. At the moment, we enable it for most of the base OS. We fixed some issues with the Chromium PartitionAlloc implementation with the latest release of Vanadium so it can now work for Vanadium too.
In the upcoming release of GrapheneOS, we've added a toggle for force enabling memory tagging for every user installed app along with a per-app toggle in case you run into an app where it doesn't work. If you enable this, you'll have memory tagging for nearly everything!
GrapheneOS already provided substantially better exploit protections than the stock Pixel OS. Difference between GrapheneOS with and without memory tagging is comparable. It's such a huge advancement we've made the rare decision to consider this new feature mandatory right away.
Alongside the new per-app and global default memory tagging toggles for user installed apps, we've also replaced the global native debugging toggle with a similar system. Many users who disabled this ran into some banking apps, games, etc. using this for weak anti-tampering.
We've also added notifications for when apps are killed due to a memory tagging violation or trying to use native debugging (ptrace).
We don't provide a toggle for memory tagging with the base OS since it works well and any issue that's found should be fixed or worked around.
If users choose to use memory tagging for user installed apps not marked as being compatible by the developers, it will be up to users to choose if they want to disable. We recommend not disabling it unless it causes frequent crashes and considering using a different app instead.
If apps bundle standalone executables run separately from their app processes, those won't have memory tagging yet unless the app developers build them with it enabled. Examples are apps running Tor as an executable. WireGuard doesn't matter since the executable made in Go not C.
Chromium barely uses the system allocator. It marks itself compatible with memory tagging but disables it by default. Latest release of Vanadium enables memory tagging, and we're going to improving it. This creates a much larger security gap between Vanadium and other browsers.
Most apps use the WebView library to handle web content. On GrapheneOS, the WebView library is Vanadium and memory tagging works for it. Some browser apps use the WebView rather than forking Chromium, so they get memory tagging protection but lack per-site sandboxing right now.
Browsers based on Chromium like Brave and Chrome need to enable memory tagging themselves. They also don't enable strict site sandboxing or CFI yet.
Browsers based on Firefox lack a content sandbox on Android, not just site isolation. They're also missing CFI and memory tagging.
Desktop Firefox has a content sandbox, but it's much weaker than the Chromium sandbox and lacks a complete implementation of site isolation. They use a fork of Chromium sandbox on Windows but in a lower security mode. On Android, they haven't enabled any form of sandboxing yet.