Chromium and Android do not rely on one fix for memory bugs. Both describe layers: containment by sandboxing, safer library code, hardware checks such as memory tagging, runtime tools in testing and production, and safer languages for new code. Each layer catches what the one above it lets through.
Layer one: contain the damage
Chromium says its architecture assumes memory bugs exist, and uses sandboxing and site isolation to contain them. It also says it is reaching the limits of that approach, partly because extra processes are costly, especially on Android. Containment limits the blast radius but does not remove bugs.
Layer two: safer C++ libraries
Chromium lists work on its base library for spatial safety, basic bounds checking in the standard library and Abseil, and generalizing its C++ garbage collector starting with PDFium. It also raises custom C++ dialects, enforced through compiler plugins and presubmit checks, and says banning raw pointers may be necessary.
Layer three: hardware
Chromium cites memory tagging as a hardware mitigation. Android's documentation describes MTE, plus GWP-ASan for catching memory bugs on deployed devices, and says platform tests are expected to run with hardware assisted sanitizers on supported Arm platforms. Android recommends integrating memory safety tools into continuous integration and testing.
Layer four: tools in test
Android's page says its compatibility definition strongly recommends memory safety tools during development. Sanitizers trade speed for detection, which is why they run in test and not in shipping builds.
Layer five: safer languages
Android says C, C++ and assembly make up over 70% of platform code, that Rust was added as a platform language in Android 12, and that Rust is expected to be preferred for most new native projects. It also says rewriting all existing unsafe code is not feasible, so Rust complements the tools. Chromium names Java, Kotlin, JavaScript, Rust and Swift where they apply, and says bridging a new language to C++ carries its own expense.
How the layers interact
Layers work best when each is understood to be incomplete. Sandboxing assumes a bug exists and limits the harm. Library checks reduce how often bugs occur in common code paths. Hardware tagging and sanitizers find bugs that slipped through, in different settings: test and production. A safer language removes whole categories from new code.
Chromium's description of its strategy shows the tradeoffs. It expects significant changes to the C++ developer experience, with some performance cost, and a new language with compile time safety checks and lower runtime cost, though bridging it to C++ carries its own expense. Neither strand is free, and both run at the same time.
Where smaller teams can start
You do not need a browser sized program. Pick one item from the middle layers: a hardened standard library mode, a sanitizer job in CI or a bounds checked container type. Each is a few days of work, shows results within a sprint and builds the habit that the larger changes need.
What this means for your team
- Do not wait for a rewrite to start. Layers two to four help now.
- Choose layers by exposure. Parsers of untrusted input deserve more of them.
- Set a rule for new native code in a safer language.
- Measure each layer by bugs found and crashes seen, not by effort spent.
Quick check
Does Android plan to rewrite all of its existing C and C++ in Rust?
The documentation says rewriting all existing unsafe code is not feasible, so Rust is meant to complement the tools and be preferred for new native work.
Sources
Last reviewed: 19 October 2026.
