Chromium project finds that 70% of security defects are memory safety problems
Does Chromium test with valgrind, various sanitizers and static checkers?  Since when?  This is 5 years of bugs.  How many would be caught by modern tools?  Could those tools be improved to catch those bugs?  I'm surprised this isn't mentioned in what they're trying, but maybe they're at the practical limit.