Rust Adoption Drives Android Memory Safety Bugs Below 20% for First Time

As The Hacker News reports on 17 November 2025, Google has disclosed that its ongoing adoption of Rust in Android has driven memory safety vulnerability density to below 20% for the first time. According to Google, there is a 1000x reduction in memory safety vulnerabilities compared with Android’s C and C++ code, and Rust changes have a 4x lower rollback rate, with 25% less time spent in code review.

The piece notes that this shift comes a little over a year after Google disclosed that its transition to Rust reduced memory safety vulnerabilities from 223 in 2019 to less than 50 in 2024. It also states that Rust code requires about 20% fewer revisions than C++ counterparts, contributing to improved development throughput.

The article cites an example vulnerability, CVE-2025-48530, in CrabbyAVIF, which could have enabled remote code execution, though it was patched as part of the August 2025 Android security update. It adds that Google emphasises a defence-in-depth approach, with Rust’s safety features as one part of a broader memory safety strategy.