Dynamic taint analysis (DTA) tracks how sensitive data flows through a program at runtime, enabling the detection of security violations such as information leaks and injection attacks. However, most DTA systems assume that memory layouts are type-safe and stable—an assumption that can be violated by type confusion. While type confusion has been studied in sandboxing and memory safety, its ability to silently bypass taint tracking without altering program behavior remains underexplored. In this paper, we present CONFUSETAINT, a technique that leverages type confusion vulnerabilities to corrupt taint metadata without modifying program semantics or the analysis tool. CONFUSETAINT exploits wide-field writes under memory reinterpretation to corrupt taint tags, breaking the integrity of tag-based tracking mechanisms commonly used in DTA systems.

We evaluate CONFUSETAINT on two widely used taint tracking frameworks: Phosphor for the JVM and TaintDroid for Android. In both cases, our attacks bypass taint tracking and allow sensitive data to reach sinks undetected—including both information leaks and injection-style flows. These results reveal a structural weakness in current DTA designs: their reliance on type-safe memory layouts leaves them vulnerable to low-level reinterpretation. Overall, our work reveals that runtime-level memory reinterpretation is an overlooked threat, calling for taint tracking architectures that do not rely on fragile assumptions about type and memory layout.