Exploit protection Allowed Blocked Default (%1$s) Disabled Enabled Restricted Warning This setting will weaken exploit protections for the selected app. Proceed Default value can be changed in the %1$s section The selected app is known to be compatible with this setting %1$s by default, because this app is known to need it. This behavior can be disabled in the %2$s section. %1$s by default because this app depends on Play services Block for third-party apps by default Restrict for third-party apps by default Disable for third-party apps by default Restricted by default Restricted by default, except for apps that depend on Play services Disabled by default Blocked by default Allowed for third-party apps by default Enabled for third-party apps by default %1$s is enabled Exploit protection compatibility mode Improves compatibility by disabling some of the GrapheneOS exploit protections for this app Hardened memory allocator Hardened memory allocator (hardened_malloc) provides substantial defenses against the most common classes of vulnerabilities (heap memory corruption) along with reducing the lifetime of sensitive data in memory. This app doesn’t have native code This is a 32-bit app, hardened_malloc is 64-bit only hardened_malloc is not allowed to be disabled for a preinstalled app This is a debuggable app, hardened_malloc can’t be disabled Extended virtual address space Extends virtual address space from 39 to 48 bits, which significantly improves the address space layout randomization. Incompatible with 32-bit apps Required by hardened_malloc Native code debugging Show notifications about blocked access attempts Native code debugging (ptrace) slightly weakens the app sandbox. Some apps (most notably banking apps) use it as a tampering detection tool. Native debugging is always blocked for preinstalled apps Memory tagging Show notifications about detected errors Memory tagging provides strong protections against exploitation of heap memory bugs (e.g. use-after-free, buffer overflow). Memory tagging is always enabled for preinstalled apps Memory tagging is always enabled for apps that don’t have native code This app has opted-in to memory tagging Enable by default This setting doesn’t apply to apps that are known to be compatible with memory tagging "Memory tagging provides strong protections against exploitation of heap memory bugs (e.g. use-after-free, buffer overflow). Memory tagging is always enabled for preinstalled apps and for third-party apps that are known to be compatible with it (e.g. apps that don’t have native code), regardless of this setting." Enabled by default Disabled by default, except for apps that are known to be compatible with memory tagging Show notifications about blocked DCL attempts This setting doesn’t apply to preinstalled apps, which are always restricted from performing DCL. Dynamic code loading via memory DCL via memory DCL via memory is always restricted for this preinstalled app "Dynamic code loading (DCL) via memory is usually performed by apps that use just-in-time (JIT) compilation to run code from outside their APKs. DCL makes the app more vulnerable to exploitation, since the dynamically loaded code can be tampered with or substituted." Dynamic code loading via storage DCL via storage DCL via storage is always restricted for this preinstalled app "Dynamic code loading (DCL) via storage refers to the app's ability to run third-party code from files that are not its APKs. DCL makes the app more vulnerable to exploitation, since the dynamically loaded code can be tampered with or substituted. Most apps that depend on Play services require DCL via storage to be allowed." WebView JIT "WebView is an OS component that is used for displaying web content inside apps. Just-in-time code compilation (JIT) significantly improves the WebView performance, but makes the app more vulnerable to exploitation. This setting doesn’t apply to preinstalled apps, WebView JIT is always disabled for the vast majority of them."