Android has transitioned to secure DMA-BUF (after much controversy with ION), which more or less alleviates the need to use a mutually-untrusted VM (pKVM https:

Android has transitioned to secure DMA-BUF (after much controversy with ION), which more or less alleviates the need to use a mutually-untrusted VM (pKVM https://youtu.be/edqJSzsDRxk https://youtu.be/edqJSzsDRxk) for Baseband isolation? Note though, OEMs are known to run 'device management' stuff with elevated privileges (not just the Baseband). Ex: see this write-up on Samsung RKP (realtime kernel protection): https://archive.is/6ClWm https://archive.is/6ClWm As for 'drivers', the GPU drivers have also a viable attack vector: https://news.ycombinator.com/item?id=34490471 https://news.ycombinator.com/item?id=34490471