Pixel 10 now runs a Rust component inside its modem. Google added it rather than rewriting decades-old baseband code.
Why the modem is the soft underbelly
Modems are unusual devices. Inside your phone, they act like a small computer called a baseband, running firmware mostly written in C and C++. That old code has been built on top of 3GPP standards for decades, and it's full of technical debt. The result: memory-management headaches that can turn into buffer overflows, memory leaks and other bugs attackers love to weaponise.
Modern smartphone operating systems offer many protections, but they don't extend to the modem like they do for the app processor. The modem speaks to cellular networks, processes radio protocols and handles real-time traffic. And because it's effectively its own operating system, vulnerabilities there can let someone run code remotely — over the internet — on your phone's baseband.
Google's Project Zero demonstrated exactly that risk by showing remote code execution was possible against a Pixel phone modem. The researchers did more than raise a red flag: their work pushed Google to rethink how it hardens this low-level, high-value target.
Rust as a surgical fix, not a rewrite
You might think to rewrite the modem firmware in a modern language, but that's just not practical. Embedded systems carry years of protocol cruft and timing constraints.
C and C++ are still used because they're fast and predictable — and because the entire modem ecosystem, from vendors to carriers, assumes that speed and behaviour.
So Google didn't rebuild the whole baseband. Instead, engineers added a Rust-based component into the Pixel 10's modem stack. The change is pragmatic: slot in a memory-safe piece where it protects the riskiest paths without touching the entire legacy codebase.
Rust provides memory safety without needing garbage collection, which is important for real-time firmware. Languages that use garbage collection — Python, C# and others — can free programmers from many memory pitfalls, but the runtime pauses and scans that garbage collectors impose are usually unacceptable in systems that must meet strict timing. The Pixel 10 approach keeps the modem's speed but reduces some of the classic memory errors by isolating new logic in Rust.
What Project Zero found — and what was fixed
Project Zero researchers have been flagging modem problems for years. Their investigations uncovered more than two dozen vulnerabilities in Exynos-based modems, with 18 of those tagged as severe. Those bugs were patched after discovery, but the pattern suggests more flaws are likely hiding in the complex code.
Google showed that remote code execution on a Pixel modem is possible, making the threat very real. The company responded not by rewriting, but by shoring up weak spots. Adding a safer Rust component is one way to reduce the attack surface while keeping the rest of the firmware intact.
Adding Rust wasn't just about security; it was also a practical engineering choice. The modem still runs legacy C/C++ where timing and low-level control matter. The Rust portion covers specific, higher-risk functions where memory-safety benefits outweigh the cost of introducing a second language into the build.
Engineering trade-offs and real-world constraints
Modem vendors and phone makers deal with trade-offs that aren't obvious from the outside. Baseband code must be fast, small and deterministic. It also must interoperate with network standards and carrier stacks. Rewriting the whole thing in a different language would impose massive verification and certification work — and likely break the strict timing guarantees the radio firmware needs.
So bootstrapping memory safety into the modem via a Rust component makes practical sense. It reduces memory-unsafe paths without forcing a wholesale replacement of tried-and-tested C/C++ blocks. That said, shoehorning a new language into a mature codebase isn't trivial. Tooling, build systems and cross-compilation for the modem's processor all need work.
Two main factors drove this approach. One: the modem is an increasingly attractive target for attackers because it sits outside the normal OS protections. Two: garbage-collected languages are normally too slow for real-time radio code. Rust sits in a kind of middle ground: memory safety with predictable performance.
What this change means for users and the industry
Pixel 10 owners probably won't notice much difference. The phones keep using the same hardware and network features. What changes is the internal mix of code that handles certain modem operations. Users won't see a setting or a label — they just get a modem that's harder for attackers to compromise via memory-corruption bugs.
Google's move points the phone industry toward a practical way to make embedded systems safer. Not every vendor will rewrite basebands. Many will likely follow the piecemeal approach: protect the riskiest interfaces with memory-safe components while leaving time-critical legacy parts in C/C++.
This method might influence how firmware is designed in the future. Expect to see more hybrid stacks: C/C++ where low-level control and latency matter, and Rust where memory bugs commonly crop up. But adoption won't be instant. Hardware makers and carriers must update toolchains and testing pipelines before they can scale such hybrid models.
Limits and unanswered questions
Rust isn't a perfect fix. Memory safety reduces a common class of bugs, but it doesn't remove every vulnerability type. Logic bugs, protocol errors, misconfigurations and design flaws can still be exploited. And because the modem remains mostly legacy code, other attack vectors persist.
Google's solution is cautious and gradual. It lowers risk on certain paths rather than promising perfect security. The work also shows how research teams like Project Zero can accelerate changes: demonstrating a painful failure mode pushed the vendor to adopt a concrete engineering shift.
Right now, the Pixel 10's Rust addition is a case study. If it succeeds in practice — reducing real-world vulnerabilities without introducing new issues — other vendors may replicate the pattern. If problems arise in cross-language interactions or in the build pipeline, that could slow uptake.
Longer-term view
Embedded systems have historically lagged the rest of the software world when it comes to language evolution. Protocols and standards that underpin cellular modems are old and stable, so the code that implements them ages slowly, too. But modern attackers are fast and inventive.
Google's hybrid approach points to a middle road: adopt safer languages where they give the biggest return, while avoiding the huge cost of wholesale rewrites. It's a practical risk-management move rather than a bold architectural pivot.
Bottom line: expect more incremental hardening across low-level firmware, and more experimentation with Rust in places where timing allows. The Pixel 10 is an early example — and a hint at how device-makers might reduce the long-term toll of decades of C and C++ in critical system code.
Related Articles
Project Zero researchers identified more than two dozen vulnerabilities in Exynos modems, 18 of them classified as "severe."
This article was created with AI assistance.
