The problem with these kinds of hardened allocators is that:

- They impact performance.

- They don’t prevent the attacker from pivoting a memory safety bug to remote execution.

- They get oversold (like calling it “secure”).

That’s not to say there aren’t allocator mitigations that help. It’s just that this isn’t it. Quarantining for example just means the attacker has to do a bit more acrobatics, but it won’t stop them.

I think what Apple is doing with typed allocations is much more principled and they have data to prove it in their blog posts