Rust in Android: move fast and... Note

Rust in Android: move fast and fix things

Android's memory safety strategy is yielding significant, compounding gains by focusing on vulnerability prevention in new code. For the first time, memory safety vulnerabilities represent less than 20% of total vulnerabilities in 2025 data. This approach not only fixes issues but also accelerates development velocity. The adoption of Rust has led to a 1000x reduction in memory safety vulnerability density compared to C and C++. Furthermore, Rust changes exhibit a 4x lower rollback rate and spend 25% less time in code review, making it a faster and safer development path. Android is expanding Rust's reach across its software stack, including the Linux kernel, firmware, and first-party applications. While Rust does have memory safety considerations, particularly in unsafe blocks, the overall vulnerability density remains drastically lower than C/C++. A recent near-miss vulnerability in unsafe Rust was mitigated by Scudo's hardened allocator, highlighting the importance of multiple security layers. Continuous improvement in understanding and managing unsafe Rust code, along with robust allocators and crash reporting, further enhances security. Ultimately, this shift demonstrates that improved security does not necessarily come at the cost of development speed or product stability.