Google Online Security Blog
Follow
Safer with Google: Advancing Memory Safety
Google is focusing on enhancing memory safety in its software development process to reduce vulnerabilities and improve security. The company acknowledges that 70% of severe vulnerabilities in memory-unsafe codebases are due to memory safety bugs, which malicious actors exploit to cause harm. Google's strategy involves migrating to memory-safe languages like Java, Kotlin, Go, and Python, and expanding the use of Rust in Android and other environments. The company is also investing in bug detection tooling, innovative research, and hardware-based approaches to improve memory safety. This includes supporting and validating the Memory Tagging Extension (MTE) and researching the Capability Hardware Enhanced RISC Instructions (CHERI) architecture. Google's commitment to memory safety is part of its Secure by Design approach, aiming to integrate security considerations throughout the entire software development lifecycle. The company believes that achieving memory safety at scale will positively impact the broader digital ecosystem.