Google Confirms 40% of Android Phones Have Fallen Behind on Security

-Kabir Jain

Updated: Tuesday, February 10, 2026, 9:54 [IST]

If your Android phone still works fine, chances are you haven’t thought much about its security status. That’s exactly the problem.

Google has confirmed that more than 40% of Android devices currently in use no longer receive critical system-level security updates. In real terms, that’s over one billion phones running software that Google no longer fully protects against new threats.

There’s no sudden bug behind this. It’s the slow result of Android phones aging past their update window while continuing to function well enough that users don’t feel any urgency to upgrade.

The cutoff most users don’t track

The key line in the sand is Android 12.

Phones running Android 12 or older are now outside Google’s core security update pipeline. That doesn’t mean they stop working or immediately become unsafe, but it does mean newly discovered system vulnerabilities may never be patched on those devices.

Android version data cited by Forbes shows how large this group really is. Only about 58% of Android phones worldwide are running Android 13 or newer. The remaining devices are split across older versions that no longer receive full OS-level protection.

In other words, this isn’t a niche problem affecting forgotten phones in drawers. It’s happening to devices people still rely on every day.

Why app-level protection isn’t enough

Google has stressed that older Android phones aren’t completely abandoned. Devices running Android 7 and newer still receive protection through Google Play Protect, which scans apps for known malware and suspicious behavior.

That helps, but it only goes so far.

System-level security updates are what close deeper holes in the operating system itself. Without those patches, app scanning can’t stop more advanced attacks that exploit flaws at the OS level. It’s the difference between locking your doors and reinforcing the structure of the house.

Confusion around Play system updates didn’t help

Recent reports of Google Play system update dates appearing to roll backward added to user anxiety. Some phones showed an older update date despite being fully up to date.

Android Authority reported that Google clarified the issue as cosmetic. According to the company, the incorrect date label does not indicate reduced protection or a rollback in security measures.

That explanation may calm some fears, but it doesn’t change the larger reality. If a phone can’t move past Android 12, it’s already outside Google’s main security safety net.

Manufacturer support is tightening the squeeze

Google isn’t the only factor here. Device makers decide how long individual models receive updates, and those timelines are shrinking for many older phones.

Samsung has confirmed that the Galaxy S21 series is no longer eligible for Android or security updates. Other models, such as the Galaxy S22 lineup and Galaxy S21 FE, are still supported but now receive updates less frequently.

As Gulf News has pointed out, Android’s update system relies heavily on manufacturers. Unlike Apple’s tightly controlled update cycle, Android phones are often left behind even while the hardware remains capable.

Why newer phones can be safer than older flagships

One uncomfortable takeaway is that age now matters more than prestige.

An older flagship phone stuck on outdated software may be less secure than a newer mid-range device running a current version of Android. From a security standpoint, ongoing updates outweigh camera quality, processor power, or premium materials.

That’s why security experts increasingly frame this as a software lifecycle issue, not a hardware failure.

What users should check today

If you’re unsure where your phone stands, checking is simple:

1. Open Settings
2. Go to About phone
3. Look at your Android version

If your device is on Android 12 or older and has no upgrade path, Google’s position is clear. It’s no longer receiving critical system-level protection, and replacing it is the only way to regain that coverage.

It’s not an easy message to hear, but it reflects how Android security now works.