diff --git a/core/clear_vars.mk b/core/clear_vars.mk
index 55d0021..d46dff3 100644
--- a/core/clear_vars.mk
+++ b/core/clear_vars.mk
@@ -191,6 +191,7 @@
 LOCAL_DPI_FILE_STEM:=
 LOCAL_SANITIZE:=
 LOCAL_SANITIZE_RECOVER:=
+LOCAL_SANITIZE_DIAG:=
 LOCAL_NOSANITIZE:=
 LOCAL_DBUS_PROXY_PREFIX:=
 LOCAL_INIT_RC:=
diff --git a/core/config_sanitizers.mk b/core/config_sanitizers.mk
index ac3e4fc..2e14fef 100644
--- a/core/config_sanitizers.mk
+++ b/core/config_sanitizers.mk
@@ -133,6 +133,11 @@
   endif
 endif
 
+ifneq ($(filter cfi,$(my_sanitize)),)
+  my_cflags += -flto -fsanitize-cfi-cross-dso -fvisibility=default
+  my_ldflags += -flto -fsanitize-cfi-cross-dso -fsanitize=cfi -Wl,-plugin-opt,O1 -Wl,-export-dynamic-symbol=__cfi_check
+endif
+
 # If local or global modules need ASAN, add linker flags.
 ifneq ($(filter address,$(my_global_sanitize) $(my_sanitize)),)
   my_ldflags += $(ADDRESS_SANITIZER_CONFIG_EXTRA_LDFLAGS)
@@ -187,3 +192,13 @@
   recover_arg := $(subst $(space),$(comma),$(LOCAL_SANITIZE_RECOVER)),
   my_cflags += -fsanitize-recover=$(recover_arg)
 endif
+
+ifneq ($(strip $(LOCAL_SANITIZE_DIAG)),)
+  notrap_arg := $(subst $(space),$(comma),$(LOCAL_SANITIZE_DIAG)),
+  my_cflags += -fno-sanitize-trap=$(notrap_arg)
+  # Diagnostic requires a runtime library, unless ASan or TSan are also enabled.
+  ifeq ($(filter address thread,$(my_sanitize)),)
+    # Does not have to be the first DT_NEEDED unlike ASan.
+    my_shared_libraries += $($(LOCAL_2ND_ARCH_VAR_PREFIX)UBSAN_RUNTIME_LIBRARY)
+  endif
+endif