Most serious mobile exploits still begin as memory corruption: a write past an object, or a use of an object after it has been freed, turned into a jump to attacker-chosen code. The fleet is built so that class of bug faults instead of running.
Memory Tagging Extension
Pixel 8 and later implement ARM MTE. The processor stores a tag on each allocation and a matching tag in the pointer. A load or store whose pointer tag does not match the allocation tag raises a fault in hardware. The fault happens before the corrupted bytes are treated as instructions. Synchronous tagging is the mode that matters here: the access fails at the instruction, not at some later audit.
hardened_malloc
Above the silicon, the allocator is hardened_malloc. It separates size classes so that a overflow in one class does not land inside another live object of a convenient type. Guard pages sit at the edges of allocations. A write that runs off the object hits an unmapped page and dies in the allocator. Quarantine of freed slots makes an immediate reuse of a dangling pointer much more likely to fault than to alias a new object.
The limit
Logic bugs, stolen passphrases, and malicious applications the operator chooses to install are not memory-corruption bugs. MTE and the allocator do not see them. They do close the historical path from a parser bug to code execution, which is the path commercial spyware has actually used.