“So, by using the GPU to access physical addresses directly, I’m able to completely bypass the protection that MTE offers.”
CVE-2023-6241 lets a malicious Android app take root on Pixel 7 and Pixel 8 phones through the Arm Mali GPU driver. Arm shipped the fix on December 14. Android users got it in the March update, three months later. Memory tagging is the Pixel 8’s headline defence, it is off by default, and the GPU walks around it anyway.