Over a billion Android phones are now exposed to hack attacks and other risks, Google warns

This situation isn’t new, and it isn’t accidental. Android’s long-standing fragmentation problem is at the heart of it.

Google develops Android, but outside of its Pixel lineup, it does not control when or if phone makers push updates. Samsung, Xiaomi, Oppo, Vivo, Motorola and others all manage their own schedules, often abandoning devices after just a few years.

By contrast, Apple controls both the hardware and software, allowing it to push updates to older iPhones far more consistently.

Only 7.5% of Android phones run the latest version

The numbers underline just how broken Android’s update pipeline remains.

Android versions still receiving security updates

•  Android 16: 7.5%


• Android 15: 19.3%


• Android 14: 17.2%


• Android 13: 13.9%

  Android versions no longer receiving security updates



•  Android 12: 11.4%


• Android 11: 13.7%


• Android 10: 7.8%


• Android 9: 4.5%


• Android 8: 2.3%

iOS shows how different this could look

For comparison, StatCounter data shows that iOS 26 runs on around 50% of iPhones, with another 40% still on iOS 18, the previous version. Even with slower adoption caused by Apple’s Liquid Glass redesign, the gap between Android and iOS update distribution remains enormous.

How to check if your Android phone is vulnerable

You can quickly see where you stand:

• Open Settings


• Scroll to About phone


• Look for Android version

That doesn’t mean buying a flagship. A modern mid-range phone that supports Android 13 or later will still receive monthly security updates and offer far better protection than an older premium device stuck on outdated software.

What about Google Play Protect?

Google notes that Play Protect still works on Android 7 and newer, providing malware scanning and updated threat signatures. A Google spokesperson told Forbes that unsupported devices still benefit from “real-time malware scanning.” However, Play Protect cannot replace missing system-level security patches, which are critical for stopping sophisticated exploits.

What’s actually at risk

An Android malware infection is not theoretical. A successful attack could Steal usernames and passwords or even cccess banking and trading apps. The malware can also intercept messages and authentication codes and ultimately drain financial accounts. This is why Google is no longer hedging its language. Keeping an unsupported Android phone is now a calculated risk.

Around one billion Android users are being asked to make a choice: stick with an unsupported device and accept the risk, or upgrade to a phone that still receives security updates. Google has already made its recommendation. The rest is up to users.