a month later

In hindsight, I'm not sure why I went with the difficult (and, in the end, frustrating) approach of contacting Proton support instead of their security team or posting on the Github tracker. OneDeuxTriSeiGo did a good thing in reporting this issue and including the tombstone.

fid02 Glad they finally noticed this issue. Memory Tagging issues are not exclusive to Proton VPN, so hopefully the other apps (Mail, Calendar, Drive) will be fixed as well.

    Glad they finally noticed this issue.

    They have been aware of the issue for months and have apparently looked into it at some point, but paused the effort some time ago. Maybe they have resumed the investigation? They are not sharing details at all, and unlike a certain other VPN competitor, they are not publicly asking for assistance in reproducing or debugging the issue, or any information at all. I know for a fact that a developer of a security software raised the issue with them a couple of months ago. Everything put together, I think it shows a surprisingly poor security posture from a company that completely depends upon their reputation of being a leader in privacy-respecting products. What if this bug had been a perfect way to deanonymize users or otherwise cause them harm? I have cancelled my subscription.

    5 days later

    If anyone's interested in testing, it looks like Proton VPN might have fixed the memory corruption bug with version 5.8.10 – currently in beta, so it's only available from Play Store.

    Have not had a single crash from memory tagging the whole day. Crashes were usually very easy to trigger.

    Make sure to select Wireguard as the protocol, if you're trying it out.

    Also don't need an account when using the beta version – can sign in as a guest and use their free servers.

      fid02
      Yay finally! Can confirm no MTE crashes so far. (For Aurora Store users, you can install this beta by selecting Manual download and entering: 605081000

        9 days later

        fid02 Thank goodness they were able to fix this. I hope this will help the dev teams for Mail, Calendar and Drive to fix the memory tagging errors in these apps too.

            2 months later