Summary
From the article:
In the last two milestones, Chrome 149 and 150, we have fixed 1072 security bugs, surpassing the total number of security bugs fixed across the prior 23 milestones combined.
[...]
Chrome is executing on a two-layered memory safety strategy: hardening our runtime environment to neutralize legacy C++ vulnerabilities, while shifting to memory-safe languages for long-term architectural resilience.
[...]
The long-term solution is shifting the codebase towards memory-safe languages like Rust, focusing on the following core tenets:
Rust flywheel. Developers cannot be expected to entirely absorb the velocity friction of engineering in a new language ecosystem. As such, we are building a centralized Rust SDK that exposes foundational Chromium APIs and tooling directly to Rust. Our aim is to turn Rust into a routine, frictionless engineering choice for new components.
Targeted “bug nest” eradication. Rust is being deployed strategically to replace code segments that exhibit high historical bug density (such as complex data parsers, image codecs, and font stacks).
Enabling high-privilege modularization. By writing new modular components in Rust, Chrome can safely execute complex features inside high-privilege processes (like the browser process) without the performance penalties of sandboxing, breaking the constraints of traditional C++ architecture.