Basically, one byte of CFG memory "controls access" to 64-bytes of executable memory - indicating which addresses are valid indirect branch targets. With approp

Basically, one byte of CFG memory "controls access" to 64-bytes of executable memory - indicating which addresses are valid indirect branch targets. With appropriate compiler and OS support this can help stop some exploits. Unfortunately it quickly gets really complicated so a bit of hand waving is necessary.