Memory Tagging Extension
The Memory Tagging Extension is a protective feature in modern ARM processors that marks memory regions with small color tags. If the tag doesn't match on access, the chip halts the program — catching entire classes of security vulnerabilities right at their root.
Every program on a phone or computer stores its data in working memory, the device’s fast temporary storage. Mistakes happen along the way: a program accidentally writes beyond the boundaries of a data region, or keeps using a region it has already released. Such errors are the most common cause of security vulnerabilities. The Memory Tagging Extension is a feature built directly into the processor chip that detects exactly these errors. It gives every memory region a kind of color tag and checks on every access whether the color matches. If it doesn’t, the access is immediately aborted. The technology was developed by the chip company ARM, whose designs are found in almost every smartphone.
Why memory errors are the most expensive bugs
Microsoft and Google have both analyzed their own security vulnerabilities for years. Both arrived at roughly 70 percent: that’s the share of vulnerabilities caused by incorrect memory access. This is no coincidence. Programming languages like C and C++ leave memory management entirely up to humans, and humans make mistakes.
Attackers love these errors because they often allow more than just a crash. Someone who can write past a boundary might overwrite exactly the spot that determines which code runs next. A harmless programming mistake thus turns into remote control of the device. Many well-known attacks on browsers and operating systems follow this pattern.
One could rewrite everything in safe languages like Rust. But billions of lines of proven C code exist in operating systems, image libraries, and network drivers. Rewriting them would take decades. Memory tagging protects exactly this existing code without requiring it to be rewritten.
Four bits of color per memory block
Memory is divided into blocks of 16 bytes each. Each block is assigned a small number, four bits in size, meaning one of 16 possible values. This number is the tag, the marking. When a program requests memory, the system colors the block with a random tag. It also writes the same value into the address the program will later use to access the block.
On every read and write access, the processor compares both values. If they match, everything continues normally. If they don’t match, the chip reports an error and the program crashes in a controlled manner. If a program writes past the block boundary, it ends up in a block with a different color — and gets caught. When memory is freed, it receives a new color, and old pointers to it no longer match.
The comparison happens in hardware and therefore costs almost no time. This is the crucial difference from checking tools like AddressSanitizer, which perform the same task in software and often slow programs down by a factor of two to three. Such tools are only used during testing. Memory tagging is meant to run permanently in the finished product. One catch remains: with only 16 colors, a random attack attempt has roughly a one-in-sixteen chance of hitting the right one. A single hit is luck, but many attempts in a row will be caught.
From the Pixel smartphone to security advisories
The technology belongs to the ARMv8.5 processor architecture and is now found in several phone chips. Google first broadly enabled it for users with the Pixel 8 devices, in the developer settings under the name Advanced Memory Protection. Android can use it to secure system services and individual apps. Linux and Chrome also support the feature.
For companies, the benefit is twofold. During live operation, memory tagging blocks attacks. During testing, it delivers very precise error reports, because the crash occurs exactly where the faulty access took place — rather than only later at some seemingly random location.
In the news, the term usually appears in two contexts: as a security feature of new chip generations, and in the policy debate around memory safety. Agencies such as the US Cybersecurity and Infrastructure Security Agency (CISA) are pushing manufacturers to eliminate memory errors altogether. Memory tagging serves as the bridge for old code, while safe programming languages are the path forward for new code.