Announcing the launch of Vanir: Open-source Security Patch Validation

Google announced Vanir, an open-source tool that automates validation of missing security patches using source-code-based static analysis, enabling fast, scalable detection of unpatched vulnerabilities across Android (and adaptable to other ecosystems). Vanir generates and refines vulnerability signatures, integrates with OSV data, supports C/C++ and Java, and has demonstrated ~95% coverage and high accuracy while integrating into CI pipelines. Released under BSD-3, it is available for public use and contributions, with the goal of accelerating patch adoption and improving ecosystem security.