Google grafted a Rust DNS parser into the Pixel 10 modem instead of rewriting it

According to Ars Technica's April 2026 report, Google's Project Zero showed it was possible to get remote code execution on Pixel phone modems over the Internet. It had found more than two dozen vulnerabilities in the Exynos modems, 18 classed as severe. Modem firmware is legacy C and C++ built over decades, tens of megabytes in size and partly treated as trade secret, so a rewrite was not realistic.

Google instead focused on the DNS parser, since cellular features now rely on DNS and parsing untrusted data is a major risk. It chose the open-source hickory-proto Rust library, not especially optimised but widely adopted. Garbage-collected safe languages were ruled out because they are too slow for real-time modem firmware; Rust gets memory safety from compile-time checks instead.

Because the Pixel modem is not memory-constrained, the team stripped the library's standard-library dependencies, compiled it to machine code and grafted it onto the existing code. The Rust components added 371KB.

Do not rewrite tens of megabytes of modem code; replace only the piece that parses untrusted DNS data with memory-safe Rust.

Rust enforces memory safety at compile time without a slow garbage collector, so real-time performance holds.

DNS parsing handles untrusted data from the network, so it is a high-value, narrow target.

The Pixel modem has the memory headroom for a 371KB addition.

Rewriting the full firmware was impractical given its size and the trade secrets involved.

You can raise security in legacy systems by swapping the narrow component that touches hostile input, instead of a full rewrite.

Pixel 10 phones are the first to ship with this modem implementation. Google hopes other platforms will follow, though the library's size could be a problem for simpler embedded systems, which a more modular library might fix. Google sees the work as a base for adding more memory-safe components to the baseband. The report does not give any measured drop in vulnerabilities.