Firefox 48 shipped Mozilla's first production Rust code: an MP4 metadata parser built by Ralph Giles and Matthew Gregan, replacing C++ on the exact code path that reads untrusted video files from strangers on the internet.

Every time Firefox plays a video, it hands an MP4 file — built by a server it doesn’t control, on behalf of a person it doesn’t know — to a parser that has to make sense of it. By 2016 that parser lived in Firefox’s Media Playback stack, written in C++, and it carried the same failure mode every hand-written C++ parser has when it processes attacker-controlled bytes: media formats, as Mozilla put it, “are known to have been used to trick decoders into exposing nasty security vulnerabilities” by exploiting memory management bugs in the browser’s own implementation code.

This isn’t a hypothetical risk category. Untrusted media parsing is one of the oldest attack surfaces in a browser, precisely because it’s unavoidable — you can’t refuse to play the video, and you can’t fully sanitize the bytes before decoding them.

The Media Playback team was the first group at Mozilla to put Rust into production. Ralph Giles and Matthew Gregan built mp4parse-rust, a memory-safe replacement for the MP4 metadata parser, and with Firefox 48 it shipped to every desktop platform, with Android support coming soon after. Mozilla’s own preliminary measurements showed “the Rust component performing beautifully and delivering identical results to the original C++ component it’s replacing” — same output, same speed, memory-safe language underneath.

A memory-safe parser is only useful if it can actually ship. Getting Rust into Firefox meant plumbing it into a build and tooling system that predated Rust by over a decade — work credited to Nathan Froyd, Nick Nethercote, Ted Mielczarek, Gregory Szorc, and Alex Crichton, who made sure the new component could compile and ship on every platform Firefox targets.

Firefox’s own telemetry showed zero issues across more than a billion uses of the new Rust code. But Mozilla was careful not to oversell it: these were “preliminary measurements,” Android support was still “coming soon,” and the announcement closed not with a victory lap but with “this is only the first step for Mozilla. Watch this space!” One parser, on desktop, was the entire scope of what shipped in Firefox 48.

A new systems language earns trust in an old C++ codebase the same way it does anywhere else: by shipping on the most boring, most attacker-exposed code path first, and matching the old system’s output exactly before it’s allowed to be different.