Rust replaces C in Android’s Binder as memory bugs fall from 76% to under 20%

01The line: Android's memory-safety share, 2019 to 2025

Google has published the series three times. In December 2022 it reported that memory-safety vulnerabilities fell from 223 in 2019 to 85 in 2022, from 76% to 35% of all Android vulnerabilities, and that Android 13 was the first release in which most new code was in a memory-safe language. It added: “correlation doesn’t necessarily mean causation”.³ In September 2024 the share was 24%, “well below the 70% industry norm”, with the 2024 count extrapolated to 36 (27 at the time).⁴ That norm is visible elsewhere: Chromium counts around 70% of its high-severity security bugs as memory-safety problems.⁶ In November 2025 Google reported the share “below 20% of total vulnerabilities for the first time”.⁵

The 2025 post adds Google’s measured density: about 0.2 vulnerabilities per million lines of Rust, against “closer to 1,000” memory-safety vulnerabilities per million lines in its historical C and C++. Rust changes also spent about 25% less time in code review, and medium and large ones were rolled back about four times less often than C++ changes.⁵

02What drives it: what memory safety is, and why C allows the bugs

A program keeps its data in memory, in slots it asks for, uses and hands back. A memory-safety bug is a mistake in that bookkeeping: writing past the end of a slot (a buffer overflow), or using a slot after handing it back (a use-after-free). Either can let an attacker overwrite data the program trusts. C gives the programmer raw memory addresses and does not check what is done with them; that is what makes it fast and close to the hardware, and what lets these mistakes through. Java and Go check at run time and clean up memory automatically. Rust checks before the program runs: its compiler refuses code that breaks its ownership rules, except inside blocks marked unsafe, which is why it can be used where C is, in kernels and drivers.

Binder shows the bug class plainly. On 16 September a fuzzer-found use-after-free write in the C driver’s device-registration code was fixed.⁸ One bug proves nothing alone. Google’s engineers gave their reasons in the Rust driver’s commit: “We’re generally not proponents of rewrites”, but Binder “combines/nests 13 different locks, 7 reference counters, and atomic variables”, and Rust “prevents mistakes with ref counting, locking, bounds checking”. The Rust driver came out at 5,500 lines against 5,800 for C, on their count.²

Rust has limits its users record. The first CVE in the kernel’s Rust code, in December 2025, was in Rust Binder: a race inside an unsafe block that corrupted list pointers and crashed the kernel.⁷ About 4% of Android’s Rust sits in such blocks, and Google caught its first Rust memory-safety bug, in an image decoder, before release.⁵ Google’s 2024 finding is that “the problem is overwhelmingly with new code”, and that returns on rewrites “diminish over time as code gets older”.⁴

03What it means for a buyer

Nothing to switch or license. The C driver stays in every kernel up to 7.3, including the long-term branches device makers build on; 7.4 is the first without it.¹¹⁶ When a given phone runs Rust Binder depends on its maker’s kernel, which the buyer does not choose. What a fleet owner can see is the Android security patch level, and what a supplier can be asked for is the plan US agencies set out: build new product lines in memory-safe languages and publish a memory-safety roadmap for existing products by the end of 2025. CISA and the FBI call that voluntary, for products used in critical infrastructure.¹³