Chrome security track proves that safe C++ programs are impossible

235 points Trader-One

Chrome Year 2024 security so far

  1. 88 chrome CVE security incidents reported
  2. 30 times use after free
  3. 11 times out of bounds memory access
  4. 6 times heap buffer overflow
  5. 1 times integer underflow
  6. 6 times type confusion (wrong casting)
  7. 4 times object corruption (accessing field using wrong reference type)
  8. no null pointer dereferences yet this year

57 of out 88 (65%) can be fully prevented in rust

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=chrome