diff --git a/cc/sanitize.go b/cc/sanitize.go
index 670443b..94c56ce 100644
--- a/cc/sanitize.go
+++ b/cc/sanitize.go
@@ -59,6 +59,7 @@
 		All_undefined  bool     `android:"arch_variant"`
 		Misc_undefined []string `android:"arch_variant"`
 		Coverage       bool     `android:"arch_variant"`
+		SafeStack      bool     `android:"arch_variant"`
 
 		// value to pass to -fsantitize-recover=
 		Recover []string
@@ -127,15 +128,20 @@
 			sanitize.Properties.Sanitize.Coverage = true
 		}
 
+		if found, globalSanitizers = removeFromList("safe-stack", globalSanitizers); found {
+			sanitize.Properties.Sanitize.SafeStack = true
+		}
+
 		if len(globalSanitizers) > 0 {
 			ctx.ModuleErrorf("unknown global sanitizer option %s", globalSanitizers[0])
 		}
 		sanitize.Properties.SanitizerEnabled = true
 	}
 
-	if !ctx.toolchain().Is64Bit() && sanitize.Properties.Sanitize.Thread {
-		// TSAN is not supported on 32-bit architectures
+	if !ctx.toolchain().Is64Bit() {
+		// TSAN and SafeStack are not supported on 32-bit architectures
 		sanitize.Properties.Sanitize.Thread = false
+		sanitize.Properties.Sanitize.SafeStack = false
 		// TODO(ccross): error for compile_multilib = "32"?
 	}
 
@@ -239,6 +245,10 @@
 		flags.CFlags = append(flags.CFlags, "-fsanitize-coverage=edge,indirect-calls,8bit-counters,trace-cmp")
 	}
 
+	if sanitize.Properties.Sanitize.SafeStack {
+		sanitizers = append(sanitizers, "safe-stack")
+	}
+
 	if sanitize.Properties.Sanitize.Recover != nil {
 		flags.CFlags = append(flags.CFlags, "-fsanitize-recover="+
 			strings.Join(sanitize.Properties.Sanitize.Recover, ","))