Microsoft "70% of CVEs Are Memory Safety" StatisticThe canonical industry data point on memory-safety vulnerability prevalence, and every follow-up through 2026.
Google: Android Rust, Chrome Rust, V8 SandboxGoogle's published 2022-2026 data on memory-safety progress — Android's 76% → <20% trajectory, the CVE-2025-48530 near-miss, the V8 sandbox.
CISA Secure-by-Design Pledge and the January 2026 Memory-Safety DeadlineThe voluntary US federal pledge that has set the de-facto industry baseline for memory-safety roadmaps.
NSA "Software Memory Safety" Guidance (2022) and the June 2025 ReissueThe NSA's formal language-level guidance, the named-language list, and the joint CISA reissue.
White House ONCD "Back to the Building Blocks" (February 2024)The White House Office of the National Cyber Director's memory-safety report and the C/C++-adverse federal stance.
DoD Safe Coding Practices and Military / Aerospace Memory-Safety Procurement (2024-2026)The DoD's evolving acquisition posture on memory-safe languages, the SWFT framework, and aerospace coding standards.
EU Cyber Resilience Act and Memory SafetyThe CRA's 2026-2027 enforcement timeline and the implicit pressure toward memory-safe languages.
Chrome Memory-Safety Data and the Rust-in-Chrome RolloutChrome Security's published per-quarter memory-safety data for 2024-2026, the JSON / PNG / fonts Rust rollouts, and the V8 sandbox.
curl, Daniel Stenberg, and the "Is C/C++ The Actual Problem?" DebateStenberg's curl CVE data, the Hyper / Rust experiment, and the unresolved 2026 question of whether memory-safe languages are the whole answer.
Use-After-Free Landscape: Temporal vs Spatial, kCFI, and the Proven-by-Construction StoryThe 2024-2026 industry picture on temporal memory safety, kernel mitigations, and the convergence of UAF defences.