Rust avoids a slow garbage collector. It relies on the borrow checker, a compile-time mechanism that enforces memory safety. Those strict rules stop you from “forgetting” to free memory—code that breaks them simply won’t compile. That is what makes Rust a memory-safe language.
Still, even Google can’t simply rewrite modem firmware—the codebase is tens of megabytes of executable machine code. Reworking decades of development would be a monumental effort, and many vendors treat modem internals as trade secrets.
To protect the Pixel modem from zero-day attacks, Google concentrated on the DNS parser. As cellular features have moved onto data networks, DNS has become a core part of how phones work. Google notes that DNS must parse untrusted input, creating a major security risk—and one that Rust can help address.
Google selected the open-source Rust DNS library hickory-proto, which isn’t highly optimized but enjoys broad adoption and support. The Pixel modem isn’t constrained for memory, so the team could add a Rust component to harden DNS handling in the existing code. They removed standard-library dependencies so it could compile to machine code for better performance, then integrated it with the existing C/C++ modem code. Overall, the Rust additions increased size by 371KB, which is acceptable for the Pixel modem.
With this design, attempts to exploit memory via crafted packets run into Rust’s protections—malicious DNS data can’t corrupt it. Pixel 10 phones are the first to ship with this safer modem implementation. Google hopes the approach can be adopted elsewhere, though it cautions the chosen Rust library’s size might be problematic for simpler embedded systems; making the library more modular could help. The company also views this as groundwork for bringing more memory-safe components into the cellular baseband over time.
