Google Announces Vanir, A Open-Source Security Patch Validation Tool

Google has open-sourced Vanir, a source-code–based static analysis tool that automates security patch validation to accelerate and improve patch adoption, especially for Android OEMs. Initially built for Android but extensible to other ecosystems, Vanir supports C/C++ and Java, covers ~95% of Android Kernel and userspace CVEs with public patches, integrates as a Python library for CI pipelines, publishes signatures via OSV, demonstrated 97% accuracy in internal testing, and can scan entire Android source trees in 10–20 minutes.