By using Safe Coding, a "secure-by-design approach that prioritizes transitioning to memory-safe languages (like Rust) for new code," Google says that the share of vulnerabilities caused by memory safety issues have plummeted from 76% in 2019 to 24% in 2024.

(2024 isn't over, obviously, so Google is extrapolating that there'll be 36 disclosed memory safety vulnerabilities in Android by the end of the year.)

Google's blog post talks in great detail about their Safe Coding approach for new code and how it "quickly and counterintuitively reduces the overall security risk of a codebase, finally breaking through the stubbornly high plateau of memory safety vulnerabilities and starting an exponential decline, all while being scalable and cost-effective."

There are two important takeaways:

1) New code is overwhelmingly the most problematic, which is why they made a fundamental change in how they developed new code.

2) However, code matures and gets safer with time, exponentially, which makes the returns on investment for things like rewrites diminish over time as code gets older.

Memory safety vulnerabilities tend to be much more severe, more likely to be remotely reachable, more versatile, and more likely to be maliciously exploited than other vulnerability types, which is a big reason why Google is looking to mitigate them.