Eliminating Memory Safety Vulnerabilities at the Source
https://security.googleblog.com/2024/09/eliminating-memory-safety-vulnerabilities-Android.html
Method
"The percent of vulnerabilities caused by memory safety issues continues to correlate closely with the development language that's used for new code"
Population
"Looking at vulnerabilities reported in the Android security bulletin, which includes critical/high severity vulnerabilities reported through our vulnerability rewards program (VRP) and vulnerabilities reported internally"
What it does not show
The organisation uses correlate rather than cause. The most recent figure is a partial-year extrapolation. The claim is about the rate at which new vulnerabilities appear, not that the class has been eliminated — most of the code is still unsafe. Full text was obtained through a text-extraction proxy rather than a direct fetch.
Google Security Blog, Android team
Memory-safety issues fell from 76% of vulnerabilities in 2019 to 24% in 2024, with the annual count dropping from 223 to 85 over 2019-2022, while the codebase remained majority memory-unsafe. The change tracks the language new code is written in rather than any rewrite of existing code.
Tier II: Multi-year observational trend from one platform’s own security bulletin record. Real production data, no control group, and the organisation states the relationship as correlation.