People say that switching to memory-safe programming languages made memory-safety bugs fall sharply. I went back to the original vendor reports to see whether they actually say that.
Google's Android numbers are real enough. Reported memory-safety bugs fell from 223 in 2019 to 85 in 2022 and an estimated 36 in 2024, and their share of all Android bugs fell from 76% to under 20% by 2025. What Google didn't claim is the interesting part: it never rewrote its old code. It wrote new code in Java, Kotlin and Rust and let the old code mature, and in 2022 Google itself said the link might be correlation rather than cause, and that researchers might simply be hunting other kinds of bug. Microsoft's much-quoted 70% is a different measurement again, the share of memory-safety bugs among certain serious bug types fixed between 2006 and 2018. It describes how common the problem was, not what happened after anyone switched languages.
The claim grew in the retelling. News coverage and government documents widened Microsoft's figure to all security bugs, credited Rust alone for the Android fall, and one US government report said migrating large code bases nearly eliminated these bugs. The source that report cites says Android didn't migrate its existing code. These are also Google's own figures, covering only serious bugs in its security bulletin, and the underlying bug list has never been published, so nobody outside can check them. Rust code has had memory-safety bugs too, including one in Android caught before release and one in the Linux kernel, though the rate does appear far lower.
So the Android fall is real on Google's data, and the idea that the language switch caused it is plausible but unproven. The broader versions in circulation aren't supported by the sources they cite. None of which means memory-safe languages don't work, and I'd still choose one.