MTE As Implemented, Part 2: Mitigation Case Studies

This analysis evaluates how attackers can bypass ARM Memory Tagging Extensions (MTE) through known-tag (e.g., Spectre-based side channels) and unknown-tag techniques, contrasting async-MTE (architecturally observable invalid accesses and soft time windows) with sync-MTE (fault-on-retire blocking most unknown-tag paths), and mapping the resulting attacker difficulty across Chrome renderer exploitation, Chrome IPC sandbox escapes, Android Binder services, and remote messaging apps; it concludes that while async-MTE can be a meaningful soft mitigation, achieving a hard deterministic mitigation likely requires sync-MTE or combinations like Scan+MTE, with generic bypasses more feasible in renderer contexts and far rarer or bespoke in IPC/Binder/one-shot remote scenarios.