1. ← Home
Login
How we’re making Chrome and the web safer in the AI Era
~ai~dev~securitygooglebrowsers
blog.google 3 weeks ago

Summary

From the article:

In the last two milestones, Chrome 149 and 150, we have fixed 1072 security bugs, surpassing the total number of security bugs fixed across the prior 23 milestones combined.

[...]

Chrome is executing on a two-layered memory safety strategy: hardening our runtime environment to neutralize legacy C++ vulnerabilities, while shifting to memory-safe languages for long-term architectural resilience.

[...]

The long-term solution is shifting the codebase towards memory-safe languages like Rust, focusing on the following core tenets:

  • Rust flywheel. Developers cannot be expected to entirely absorb the velocity friction of engineering in a new language ecosystem. As such, we are building a centralized Rust SDK that exposes foundational Chromium APIs and tooling directly to Rust. Our aim is to turn Rust into a routine, frictionless engineering choice for new components.

  • Targeted “bug nest” eradication. Rust is being deployed strategically to replace code segments that exhibit high historical bug density (such as complex data parsers, image codecs, and font stacks).

  • Enabling high-privilege modularization. By writing new modular components in Rust, Chrome can safely execute complex features inside high-privilege processes (like the browser process) without the performance penalties of sandboxing, breaking the constraints of traditional C++ architecture.