pretty much! this 2013 paper added low overhead (4%?) forward and backward CFI at the binary level, tested on internet explorer and firefox: http://www.cs.berke

pretty much! this 2013 paper added low overhead (4%?) forward and backward CFI at the binary level, tested on internet explorer and firefox: http://www.cs.berkeley.edu/~dawnsong/papers/Oakland2013-CCFIR-CR.pdf http://www.cs.berkeley.edu/~dawnsong/papers/Oakland2013-CCFI... this paper (2014) does forward CFI on chrome for 4% overhead: https://www.eecs.harvard.edu/cs261/papers/tice-2014.pdf https://www.eecs.harvard.edu/cs261/papers/tice-2014.pdf IE on windows 8.1 (including adobe flash) is compiled with forward control flow integrity: https://blog.coresecurity.com/2015/03/25/exploiting-cve-2015-0311-part-ii-bypassing-control-flow-guard-on-windows-8-1-update-3/ https://blog.coresecurity.com/2015/03/25/exploiting-cve-2015... note that the exploitation strategy CORE used leveraged JIT, few systems (with some notable exceptions like librando) acknowledge JIT in their work. so this technology is out there...