#security
2 posts tagged #security.
Chrome fixed 1,072 security bugs in two releases and 97% of its code is span-clean
Chrome 149 and 150 fixed more security bugs than the previous 23 milestones combined, and 97% of first-party Chrome code now compiles cleanly under strict unsafe-buffer warnings. The strategy is worth reading closely: harden C++ aggressively, migrate selectively, and admit openly that runtime mitigations are approaching diminishing returns.
C++ Safety State of the Union: May 2026
C++ in May 2026 has four conversations running at once: regulators (CISA, EU CRA) demanding memory-safety roadmaps; the committee fighting over how to respond (Hagenberg vote 19 profiles / 9 Safe C++ / 11 both); what actually shipped in C++26 (P2900 contracts, P3471 hardened stdlib, P2996 reflection); and what the industry actually deployed (Chrome MiraclePtr -57% UAF, Google's 0.3% perf-cost data, Apple libc++ safe-buffers). They don't talk to each other in public. This essay wires them. Pre-Brno (8-13 June) reading.