A growing patch gap
A rising share of the Android ecosystem is running on older software, and that reality carries risk. Recent StatCounter figures, cited by Android Headlines, show more than 30% of users remain on Android 13 or earlier, and many of those devices are no longer receiving updates.
This translates into nearly a billion handsets that are easier targets for attackers. While Android 13 still gets security fixes, Android 12 and below have lost official support, a cutoff Android Authority noted occurred in April.
Why security updates matter
Security patches don’t add shiny features, but they quietly close dangerous holes. They fix exploited bugs, harden weak components, and neutralize new threats before they become headlines.
The most recent Android bulletin reportedly addressed 107 vulnerabilities, an illustration of how many cracks a single update can seal. Skip enough cycles and those cracks become entry points for credential theft, spyware, or ransomware.
“Security updates aren’t extras; they’re the seatbelts of your data.”
Who is most at risk
Aging phones in active daily use—for banking, two-factor codes, and messaging—are the most exposed. Attackers prize predictable, unpatched targets, especially when they can weaponize known CVEs that vendors no longer fix.
The risk isn’t limited to Android. A Zimperium report suggests more than 50% of all smartphones run obsolete OS versions, across both Android and iOS, widening the global attack surface for opportunistic actors.
What you can do now
If your device is stuck on an unsupported version, you still have practical options:
- Check your OS and security patch level in Settings and confirm the latest available update; apply it immediately.
- Enable Google Play system updates (Project Mainline) to receive modular patches where supported.
- Remove unnecessary apps that expand your attack surface and review their sensitive permissions.
- Only install software from reputable stores and avoid sideloading unsigned APKs.
- Use a modern, well-maintained browser and keep it rigorously updated.
- Turn on automatic backups and prepare a migration plan to a supported device.
- Consider a privacy-focused DNS or reputable mobile security suite for extra signals.
- If the phone can’t be patched, plan a responsible trade-in or certified e-waste recycling.
The industry is changing—slowly
Manufacturers are finally extending software lifespans, aligning with environmental and consumer pressure. Google and Samsung now promise up to seven years of major and security updates, a leap from past policies.
Apple rarely advertises timelines, yet it continues shipping security fixes to iPhone XS, XS Max, and XR—models launched in 2018—showing that long-tail support is technically feasible. But extended commitments vary by brand, market, and device tier.
What this means for businesses
Enterprises with bring-your-own-device programs face elevated exposure if unmanaged personal phones fall behind on patches. Threat actors frequently exploit known vulnerabilities with available proof-of-concept code.
Organizations should enforce minimum OS versions, require strong device attestation, and block outdated builds from accessing critical systems. Mobile device management policies should prioritize swift remediation and clear user guidance.
The environmental tension
Keeping hardware for longer is good for the planet and your budget, but it clashes with short software windows. When updates end, secure use becomes a moving target, pushing owners toward premature replacements.
Longer support reduces e-waste and improves overall safety, but it depends on sustained vendor investment. Without that, users must choose between insecurity and upgrade, a trade-off that shouldn’t be necessary.
The bottom line
An enormous slice of the Android base is now easier to compromise, not because users are careless, but because their devices can’t be patched. The combination of aging software, known exploits, and persistent monetization by criminals forms a durable threat.
If your phone can still receive updates, install them right away. If it can’t, minimize your exposure—and make a plan to move to a supported device with a longer update horizon. Proactive steps today can keep your data private and your mobile life resilient.
