Google says transitioning to memory-safe languages like Rust led to the share of memory-safe vulnerabilities in Android dropping from 76% in 2019 to 24% in 2024
Google has revealed that its transition to memory-safe languages such as Rust as part of its secure-by-design approach has led …
Context & Ripple Effects
Android’s Rust path began when the Android Open Source Project added support for developing OS components in the language in 2021. Google had already identified memory-safety issues as a major source of serious bugs in Chrome, making language choice a security-engineering concern rather than a tooling preference.
The reported change gives that migration an outcome measure; subsequent coverage also projected far fewer reported Android memory-safety flaws after memory safety was adopted for new code.
First-order effects
- Google can point to a substantially smaller memory-safety share in Android’s vulnerability mix, strengthening the case for Rust and other memory-safe languages in new Android code.
- Android engineering teams have a clearer security rationale to prioritize memory-safe implementations where they are practical, rather than treating C/C++ as the default for OS-level work.
Second-order effects
- The result raises the bar for other Google codebases and OS teams that still rely heavily on C/C++; Google’s earlier finding that memory-safety flaws dominated serious Chrome bugs makes the comparison especially salient.
- Rust’s role in Android becomes more credible to developers and maintainers deciding whether the cost of introducing a newer systems language is justified by fewer vulnerability classes.
Third-order effects
- If similar results persist, secure-by-design programs will increasingly make memory safety a platform-architecture decision, shifting investment from downstream vulnerability fixes toward language and component selection upfront.
- The constraint is that the evidence reflects one organization’s reported results and a transition in new code; legacy code and non-memory-safety flaws will determine how far the model generalizes.
The trend: Major software platforms are moving memory safety from an optional language feature to a measurable secure-by-design strategy for reducing recurring vulnerability classes.