Updated Android data for 2025 shows that memory-safety vulnerabilities have fallen below 20% of all vulnerabilities for the first time, coinciding with the expanded use of Rust in new and actively developed parts of the platform. According to an analysis published on the Google Security Blog on November 12, 2025, the transition from C and C++ to Rust not only reduces security risks but also speeds up code review and improves the stability of changes.
The data is based on changes to Android code, whether developed directly by Google or belonging to third-party open-source projects, and covers C, C++, Java, Kotlin, and Rust. Because the analysis was published a few months before the end of 2025, Google explained that the standard 90-day bug-fixing window makes the results very close to the final figures, with the possibility of accelerating fixes when necessary.
Higher Security and Faster Delivery
Google introduced Rust into Android as a direct alternative to C and C++ for low-level programming, while retaining a similar level of control and predictability but greatly reducing risks associated with memory safety. The analysis points to a sharp increase in the volume of new Rust code, alongside a slower but steady decline in new C++ code, until the volume of newly added Rust became close to that of C++, enabling more reliable comparisons between the two development paths.
Google used the DORA framework to measure productivity and stability. To reduce the difficulties of comparing languages, it focused on similarly sized changes and similar groups of developers working on the Android platform, while also tracking trends over time as Rust adoption increased.
Rust changes of comparable size require about 20% fewer reviews than their C++ counterparts. They also currently spend about 25% less time in code review. Google attributes, speculatively rather than conclusively, the notable improvement between 2023 and 2024 to the Android team’s increased experience with Rust.
In terms of stability, medium and large Rust changes have a regression rate about four times lower than C++ changes. Google emphasizes that fewer rollbacks reflect not only the quality of changes but also increase productivity, because a rollback can lead to rework, additional reviews, rebuilding, post-incident reports, and disruption to other teams.
Rust Expands Beyond System Services and Libraries
Google says Rust support has matured for building Android system services and libraries, and it is therefore working to expand its use to other layers of the ecosystem:
- Kernel: Android’s Linux 6.12 kernel is Google’s first kernel with Rust support enabled, and it also includes the first production Rust driver. Google continues to work with Arm and Collabora on a driver for a graphics processing unit that operates in kernel mode.
- Firmware: Google believes that elevated privileges, performance constraints, and the limited availability of certain protections make firmware high-risk and difficult to secure. It says it has used Rust in firmware for years and has made training lessons and code available to the community, with a particular focus on its collaboration with Arm through Rusted Firmware-A.
- Google applications: The Nearby Presence protocol, used to securely and privately discover nearby devices over Bluetooth, runs in Rust within Google Play Services. The MLS protocol for secure messaging over RCS will also be included in the Google Messages application in a future release.
- Chromium: PNG and JSON parsers and web fonts have been replaced with memory-safe implementations written in Rust, making it easier for Chromium engineers to handle data originating from the web while following the Rule of 2.
A Vulnerability That Nearly Reached Users
Despite its focus on Rust’s advantages, Google describes a case that came close to becoming Android’s first Rust-based memory-safety vulnerability to be recorded. A linear buffer overflow in CrabbyAVIF was discovered before it reached a public release, and the fix was assigned CVE-2025-48530 to ensure that it received high priority and that its progress could be tracked through the release channels.
The analysis showed that the Scudo Hardened Allocator made exploitation of the vulnerability deterministically impossible, thanks to guard pages surrounding secondary allocations. Scudo also turned the overflow from silent memory corruption into an obvious crash, which helped reveal the issue. At the same time, the incident exposed a shortcoming in the crash-reporting system, which did not clearly indicate that the crash resulted from an overflow, slowing triage and response. Google says this shortcoming has been addressed and that the system now provides a clear signal when overflows reach Scudo guard pages.
Why Does Rust Remain Important Despite the Presence of unsafe?
Google does not consider banning unsafe code, whether in C, C++, or Rust, a practical solution for operating-system development, because of the need to interact with application programming interfaces and hardware. It is therefore developing an advanced module on unsafe code as part of Comprehensive Rust training, teaching developers how to evaluate the safety of such code and undefined behavior, use safety comments, and encapsulate unsafe sections within safe abstractions.
Based on approximately five million lines of Rust in the Android platform and one potential case addressed before release, Google estimates the density of memory-safety vulnerabilities in Rust at about 0.2 vulnerabilities per million lines. It compares this with a historical density of approximately 1,000 vulnerabilities per million lines in C and C++, meaning a reduction of more than 1,000 times according to its estimate. It also notes that about 4% of the code is written inside unsafe{} blocks, but says that assuming every unsafe line faces the same risks found in C or C++ overestimates the danger, given that most Rust checks remain in place, unsafe code can be encapsulated, and it undergoes additional scrutiny.
Google concludes that adopting Rust changes the traditional equation that linked improved security with additional costs in performance, processes, or feature-release speed. While C and C++, as well as software and hardware protection mechanisms, remain important within a defense-in-depth strategy, the company believes that moving to Rust provides a safer and more efficient path at the same time, rather than accelerating first and addressing the consequences later.