Android is a Linux kernel written in C, so it's memory unsafe there. The apps are in a Java-derivative, so they're memory safe. Chrome browser is not written in this language, so it's memory unsafe.

iOS is a Mach+XNU kernel written in C, so it's memory unsafe there. The apps are in Swift, so they're memory safe. Safari/Webkit is not written in this language, so it's memory unsafe.

The only real difference in security here is that Apple has had better sandboxing and security (hardware) implementations.