302808 2025-11-19 11:21:01 -0800 [libpas] Implement Previous-Tag-Exclusion for MTE allocations 2026-04-07 11:08:49 -0700 1 1 1 Unclassified WebKit New Bugs WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 marcus_plutowski webkit-unassigned webkit-bug-importer oldest_to_newest 2159998 0 marcus_plutowski 2025-11-19 11:21:01 -0800 rdar://152167632 In a similar vein to Adjacent-Tag-Exclusion, we can impair the ability of attackers to 'get lucky' with MTE tags by ensuring that 'local' (for ATE spatially local, for PTE temporally local) allocations have different tags. In this case that means that when we retag an object in a slot that previously had some tag A, we make sure to use a tag other than A. This does not provide as hard of a guarantee as ATE does, as ATE deterministically ensures that adjacent allocations will not have the same tag -- whereas in theory heap grooming could be used to re-reallocate on a given slot, thus dodging the prior tag. This is however still an added layer of difficulty and worth considering as a hardening option. 2160023 1 marcus_plutowski 2025-11-19 12:09:17 -0800 Pull request: https://github.com/WebKit/WebKit/pull/54200 2196026 2 marcus_plutowski 2026-04-01 15:01:23 -0700 Pull request: https://github.com/WebKit/WebKit/pull/61853 2197698 3 ews-feeder 2026-04-07 11:08:47 -0700 Committed 310726@main (569d28c26a9b): <https://commits.webkit.org/310726@main> Reviewed commits have been landed. Closing PR #61853 and removing active labels.