Control Flow Integrity for Vanadium

OpenSource-Ghost

I noticed that Cromite browser developer mentions disablement of Control Flow Integrity (CFI) in the later versions of Cromite because of an introduced bug (https://github.com/uazo/cromite/discussions/292). Does Vanadium browser use CFI? Is it affected by the same bug?

final

Vanadium on GrapheneOS uses Control-Flow Integrity and sometimes patches and fixes towards it are added to make it more compatible. For example you can see is_cfi = true is enabled in the arguments:

https://github.com/GrapheneOS/Vanadium/blob/main/args.gn

An example of a CFI fix here: https://github.com/GrapheneOS/Vanadium/commit/6837823ecd2b1ba1cef04d3a3a0bb6b42fe6ebab

The CFI issue for Cromite in this instance is related to an upstream issue, it appears in the discussion they talk about this crash also happening on vanilla Chromium with CFI enabled as well. CFI violations are known to happen in the upstream.