Opt-in to Arm MTE

[thgoebel]

This is an easy security improvement (at least for users with Google Pixel 8 and later, which have the hardware for MTE).

Nextcloud doesn't have any explicit native code itself. But there are some libandroidx.graphics.path.so files in the APK, and also Android framework code that Nextcloud calls might have native code. All of that runs in the app's process, so opting in to MTE will cover that. Nextcloud parses potentially attacker controlled data, so enabling MTE is an easy defense-in-depth.

I've been running Nextcloud on a Pixel 8a with GrapheneOS and MTE force-enabled for a few months now without any issues.
Still, I recommend you to test this again on an MTE-compatible device (Pixel 8 and later), just to be sure :)

I'm only sending PRs for Files and Notes for Android, because those I use a lot and can (at)test.
I recommend you enable MTE for other Android apps (Talk, Deck) as well, and also for the Nextcloud iOS Files app.

For background on MTE, see:

• Android docs: https://source.android.com/docs/security/test/memory-safety/arm-mte
• iOS docs: https://developer.apple.com/documentation/xcode/enabling-enhanced-security-for-your-app
• My blog post 😇 : https://thore.io/posts/2025/09/introduction-to-arm-memory-tagging-extensions/

[github-actions]

APK file: https://www.kaminsky.me/nc-dev/android-artifacts/15661.apk



To test this change/fix you can simply download above APK file and install and test it in parallel to your existing Nextcloud app.

[tobiasKaminsky]

I think this is the more accurate documentation: https://developer.android.com/ndk/guides/arm-mte

Your linked one is for platform devs.

I unfortunately do not have such a device.

@mahibi do you have a Pixel?

[github-actions]

Hello there,
Thank you so much for taking the time and effort to create a pull request to our Nextcloud project.

We hope that the review process is going smooth and is helpful for you. We want to ensure your pull request is reviewed to your satisfaction. If you have a moment, our community management team would very much appreciate your feedback on your experience with this PR review process.

Your feedback is valuable to us as we continuously strive to improve our community developer experience. Please take a moment to complete our short survey by clicking on the following link: https://cloud.nextcloud.com/apps/forms/s/i9Ago4EQRZ7TWxjfmeEpPkf6

Thank you for contributing to Nextcloud and we hope to hear from you soon!

(If you believe you should not receive this message, you can add yourself to the blocklist.)