Google has disclosed that the corporate’s continued adoption of the Rust programming language in Android has resulted within the variety of reminiscence security vulnerabilities falling under 20% of complete vulnerabilities for the primary time.
“We adopted Rust for its safety and are seeing a 1000x discount in reminiscence security vulnerability density in comparison with Android’s C and C++ code. However the largest shock was Rust’s affect on software program supply,” Google’s Jeff Vander Stoep stated. “With Rust adjustments having a 4x decrease rollback charge and spending 25% much less time in code evaluate, the safer path is now additionally the sooner one.”
The event comes a bit over a 12 months after the tech big disclosed that its transition to Rust led to a decline in reminiscence security vulnerabilities from 223 in 2019 to lower than 50 in 2024.
The corporate identified that Rust code requires fewer revisions, necessitating about 20% fewer revisions than their C++ counterparts, and has contributed to a decreased rollback charge, thereby bettering total growth throughput.
Google additionally stated it is planning to increase Rust’s “safety and productiveness benefits” to different elements of the Android ecosystem, together with kernel, firmware, and demanding first-party apps like Close by Presence, Message Layer Safety (MLS), and Chromium, which has had its parsers for PNG, JSON, and net fonts changed with memory-safe implementations in Rust.
Moreover, it has emphasised the necessity for a defense-in-depth strategy, stating that the programming language’s built-in reminiscence security options are only one a part of a complete reminiscence security technique.
For instance, Google highlighted its discovery of a reminiscence security vulnerability (CVE-2025-48530, CVSS rating: 8.1) in CrabbyAVIF, an AVIF (AV1 Picture File) parser/decoder implementation in unsafe Rust, that would have resulted in distant code execution. Whereas the linear buffer overflow flaw by no means made it right into a public launch, it was patched by Google as a part of its Android safety replace for August 2025.
Additional evaluation of the “near-miss” vulnerability discovered that it was rendered non-exploitable by Scudo, a dynamic user-mode reminiscence allocator in Android that is designed to fight heap-related vulnerabilities, equivalent to buffer overflow, use after free, and double free, with out sacrificing efficiency.
Emphasizing that unsafe Rust is “already actually fairly secure,” Google stated the vulnerability density is considerably decrease versus C and C++, including that the incorporation of an “unsafe” code block in Rust does not routinely disable the programming language’s security checks.
“Whereas C and C++ will persist, and each software program and {hardware} security mechanisms stay crucial for layered protection, the transition to Rust is a special strategy the place the safer path can be demonstrably extra environment friendly,” it stated.
Elevate your perspective with NextTech Information, the place innovation meets perception.
Uncover the newest breakthroughs, get unique updates, and join with a worldwide community of future-focused thinkers.
Unlock tomorrow’s tendencies immediately: learn extra, subscribe to our publication, and grow to be a part of the NextTech neighborhood at NextTech-news.com
