“Memory safety issues, which accounted for 76% of Android vulnerabilities in 2019, and are currently 24% in 2024, well below the 70% industry norm, and continuing to drop.”
Android started writing new code in memory-safe languages around 2019 and left most of the old C and C++ alone. Memory safety bugs still fell from 76% of Android vulnerabilities to 24%. Google’s own numbers say 5-year-old code has 3.4x to 7.4x lower vulnerability density than new code. The bugs live in what you wrote last month, so the big rewrite is the wrong fight.