Over a billion Android phones are now exposed to hack attacks and other risks, Google warns

Android

• Android 12 or older devices no longer get security patches from Google
• About 42.1% of Android phones are now exposed to new malware and spyware risks
• Google advises users to upgrade phones if stuck on Android 12 or older

Did our AI summary help?

Google has confirmed that Android devices running Android 12 or older no longer receive security patches. That decision has left an estimated 42.1% of Android phones exposed to new malware and spyware attacks.

According to the latest Android distribution numbers, only 57.9% of devices are running Android 13 or newer. Everything below that line is effectively frozen in time, security-wise.

Phones released in 2021 or earlier are the most affected, and the number hasn’t meaningfully improved over the past year. Roughly one billion Android users worldwide remain stuck on unsupported software.

Android fragmentation is the real culprit

This situation isn’t new, and it isn’t accidental. Android’s long-standing fragmentation problem is at the heart of it.

Google develops Android, but outside of its Pixel lineup, it does not control when or if phone makers push updates. Samsung, Xiaomi, Oppo, Vivo, Motorola and others all manage their own schedules, often abandoning devices after just a few years.

By contrast, Apple controls both the hardware and software, allowing it to push updates to older iPhones far more consistently.

Only 7.5% of Android phones run the latest version

The numbers underline just how broken Android’s update pipeline remains.

Android versions still receiving security updates

•  Android 16: 7.5%
• Android 15: 19.3%
• Android 14: 17.2%
• Android 13: 13.9% Android versions no longer receiving security updates
•  Android 12: 11.4%
• Android 11: 13.7%
• Android 10: 7.8%
• Android 9: 4.5%
• Android 8: 2.3%

In total, more than four out of every ten Android phones are now outside Google’s official security umbrella.

iOS shows how different this could look

For comparison, StatCounter data shows that iOS 26 runs on around 50% of iPhones, with another 40% still on iOS 18, the previous version. Even with slower adoption caused by Apple’s Liquid Glass redesign, the gap between Android and iOS update distribution remains enormous.

How to check if your Android phone is vulnerable

You can quickly see where you stand:

• Open Settings
• Scroll to About phone
• Look for Android version

If your phone is on Android 12 or older and cannot be upgraded, it is no longer receiving security patches from Google. Google’s advice: upgrade, even if it’s mid-range Google’s position is blunt. If your phone can’t move past Android 12, you should replace it.

That doesn’t mean buying a flagship. A modern mid-range phone that supports Android 13 or later will still receive monthly security updates and offer far better protection than an older premium device stuck on outdated software.

What about Google Play Protect?

Google notes that Play Protect still works on Android 7 and newer, providing malware scanning and updated threat signatures. A Google spokesperson told Forbes that unsupported devices still benefit from “real-time malware scanning.” However, Play Protect cannot replace missing system-level security patches, which are critical for stopping sophisticated exploits.

What’s actually at risk

An Android malware infection is not theoretical. A successful attack could Steal usernames and passwords or even cccess banking and trading apps. The malware can also intercept messages and authentication codes and ultimately drain financial accounts. This is why Google is no longer hedging its language. Keeping an unsupported Android phone is now a calculated risk.

Around one billion Android users are being asked to make a choice: stick with an unsupported device and accept the risk, or upgrade to a phone that still receives security updates. Google has already made its recommendation. The rest is up to users.