![\"Photo](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/09\/Photo-of-an-Android-phone-with-out-of-date-software-scaled.jpg\"\/ "\\"Photo")
<\/p>\n<\/p>\n
Mishaal Rahman \/ Android Authority<\/p>\n
For the past decade, Google has consistently published an Android Security Bulletin every month, even if the company wasn\u2019t ready to roll out a security update to its own Pixel devices. These bulletins detail the vulnerabilities that have been fixed in that month\u2019s security release, with issues ranging from low to critical in severity. Given how large and complex the Android operating system and its underlying components are, it\u2019s not unusual to see a dozen or more vulnerabilities documented in a bulletin. However, the July 2025 bulletin<\/a> broke this decade-long trend: out of the 120 bulletins published up to that point, it was the first ever to not list a single vulnerability.<\/p>\n In contrast, the latest September 2025 bulletin<\/a> listed a whopping 119 vulnerabilities. This disparity doesn\u2019t mean Google had nothing to disclose in July; rather, it reflects strategic changes the company made to its Android security update process. These changes aim to help device manufacturers (OEMs) address high-risk issues more quickly and better protect users from active exploitation. Here\u2019s what\u2019s changing.<\/p>\n You\u2019re reading the Authority Insights Newsletter, a weekly newsletter that reveals some new facet of Android that hasn\u2019t been reported on anywhere else. If you\u2019re looking for the latest scoops, the hottest leaks, and breaking news on Google\u2019s Android operating system and other mobile tech topics, then we\u2019ve got you covered.<\/p>\n Subscribe here<\/a> to get this post delivered to your email inbox every Saturday.<\/p>\n The life of a security patch: How Android security updates used to work<\/p>\n Google has done a lot of work over the years to proactively protect Android from vulnerabilities. For example, it writes new code in memory-safe languages like Rust and implements anti-exploitation protections such as hardware-backed control flow integrity (CFI) and memory tagging (MTE). These security improvements, coupled with Google\u2019s efforts to speed up Android updates<\/a> and modularize the OS through initiatives like Project Mainline<\/a>, have made it difficult for bad actors to find and abuse critical security vulnerabilities. But with such a large, complex, and constantly updating codebase, some vulnerabilities are always waiting to be found.<\/p>\n Rita El Khoury \/ Android Authority<\/p>\n While anyone can find Android security vulnerabilities, bad actors aren\u2019t going to report them to Google. Instead, the vulnerabilities that get patched are privately reported by responsible researchers who work independently, for firms that partner with Google, or for Google itself. The Android security team then triages these reports to verify a vulnerability\u2019s existence, assess its potential impact, and assign a severity rating (e.g., Moderate, High, or Critical). Once validated, the vulnerability receives a unique Common Vulnerabilities and Exposures (CVE)<\/a> identifier to make it easier to track. Finally, Google\u2019s engineers, often in collaboration with the original reporter, develop and test a patch to fix the issue.<\/p>\n Once Google has finalized a security patch, the company doesn\u2019t immediately release it. This is because it has no way of rolling out a security update to all Android devices over-the-air. The only exception is when the impacted component is part of a Project Mainline module, in which case Google itself can distribute a fix to all devices through a Google Play System Update<\/a>. While Google could submit the patch to the Android Open Source Project (AOSP)<\/a> as soon as it\u2019s ready, doing so would immediately publicize the vulnerability. The company refrains from this approach because it would leave partners scrambling to merge, test, and roll out an update.<\/p>\n This is why Google created the Android Security Bulletin (ASB). The ASB coordinates the disclosure of numerous security patches, grouping them into a single monthly release cycle so partners aren\u2019t overwhelmed. There are two versions of the ASB: a public and a private one. The public ASB has been published every month since August 2015 and generally goes live on the first Monday of the month. The private ASB, on the other hand, is distributed to OEMs and chipset vendors approximately 30 days in advance, providing them with essential lead time to merge and test the patches before they\u2019re publicly disclosed.<\/p>\n Here\u2019s a timeline showing how a hypothetical vulnerability is handled, from its discovery to its inclusion in a public ASB. Keep in mind that the time it takes to triage and patch a vulnerability is highly variable. The timeline also illustrates a key delay: since the patch was finalized after the private ASB for September 2025 had already been sent to partners, it had to be included in the next one.<\/p>\n Mishaal Rahman \/ Android Authority<\/p>\n Even with this lead time, some OEMs struggle to roll out security updates for all their devices each month. In fact, many don\u2019t even commit to monthly security updates for their entire lineup; their update policies<\/a> often stipulate that budget and mid-range devices only qualify for bi-monthly or quarterly patches. This is a common challenge for manufacturers managing heavily customized versions of Android across massive device portfolios. On top of that, they often need carrier approval to release updates in some regions. As a consequence, many Android devices are left without the latest security patches and are vulnerable to exploitation.<\/p>\n Google\u2019s solution to this problem is to change the security update process. The company is adopting a new release strategy it calls the \u201cRisk-Based Update System\u201d (RBUS), which is designed to improve the security patching process for OEMs without sacrificing user security.<\/p>\n How Android\u2019s new risk-based update process works<\/p>\n Instead of bundling all available security patches into the next ASB, Google now prioritizes shipping only \u201chigh-risk\u201d vulnerabilities in its monthly releases. The majority of security fixes, meanwhile, will be shipped in quarterly ASBs. Google defines \u201chigh-risk\u201d vulnerabilities as issues that are crucial to address immediately, such as those under active exploitation or that are part of a known exploit chain. This designation is based on real-world threat level and is distinct from a vulnerability\u2019s formal \u201ccritical\u201d or \u201chigh\u201d severity rating.<\/p>\n This new approach has several key benefits for OEMs:<\/p>\n OEMs have fewer patches to merge, test, and ship each month. This reduces the difficulty of shipping monthly updates and may result in some OEMs shipping them more frequently for more devices. Because Google\u2019s monthly bulletins now only include vulnerabilities it deems \u201chigh-risk,\u201d some ASBs may list zero fixes. This is exactly what happened with the July 2025 ASB. That doesn\u2019t mean there were no Android vulnerabilities to address; Samsung and Qualcomm, for instance, each listed multiple CVEs in their own July 2025 bulletins. However, since Google\u2019s bulletin no longer lists most vulnerabilities, OEMs can choose whether to release security updates even when the official ASB is empty. For those that do, like Samsung, Google\u2019s only stipulation is that they don\u2019t publicly publish any details about the CVEs they patched.<\/p>\n A direct consequence of this change is that the March, June, September, and December ASBs will be substantially larger, as they align with Android\u2019s new quarterly release schedule<\/a>. This explains why the September 2025 ASB listed a staggering 119 vulnerabilities, compared to the zero and six listed in the July and August 2025 bulletins, respectively. Since most security fixes will now arrive in these quarterly releases, OEMs are encouraged to adopt at least a quarterly update schedule for their devices to maximize user protection.<\/p>\n Here\u2019s a timeline showing how a hypothetical low-risk vulnerability would be handled under the new Risk-Based Update System. Again, the time it takes to triage and patch a vulnerability will differ depending on the issue in question. Compare this to the previous timeline I showed, which now applies to high-risk vulnerabilities.<\/p>\n Mishaal Rahman \/ Android Authority<\/p>\n Google hasn\u2019t publicly announced its shift in release strategies for Android security updates, but Android Authority has spoken to multiple sources who confirmed the change. When we reached out to Google for comment, a spokesperson had the following to say:<\/p>\n \u201cAndroid and Pixel security bulletins are published monthly. To keep users safe, we build powerful security deep into Android\u2019s foundation. Android stops most vulnerability exploitation at the source with extensive platform hardening, like our use of the memory-safe language Rust and advanced anti-exploitation protections. Android and Pixel continuously address known security vulnerabilities and prioritize fixing and patching the highest-risk ones first.\u201d \u2013 A Google spokesperson<\/p>\n For most users, this new security release approach won\u2019t change much. If you already receive monthly security updates, you\u2019ll continue to get them. If you don\u2019t, this change may help your device\u2019s manufacturer deliver them more consistently. At the very least, it should make it easier for all OEMs to push out the quarterly updates, which are now far more impactful.<\/p>\n There is one potential downside to the Risk-Based Update System, as highlighted by the folks behind GrapheneOS<\/a>, a privacy and security-oriented fork of AOSP. In the past, Google gave OEMs a one-month heads-up. Now, they receive several months of advance notice for the larger quarterly updates. This longer window could be problematic, as it gives bad actors more time to potentially find leaked vulnerability details and develop exploits before patches are widely available. While the private ASB is shared securely, it\u2019s accessible to tens of thousands of engineers across dozens of companies, making it conceivable that details could leak to malicious third parties. This remains a hypothetical risk, though, as it would require bad actors to leverage the right exploit on the right devices before they\u2019re patched.<\/p>\n Another downside is that Google is no longer releasing the source code for monthly security updates, only for quarterly ones. This, in conjunction with other delays in OS source code<\/a>, means most custom ROMs can\u2019t ship monthly updates anymore. Add this to the pile of other things that make it harder to mod your Android phone in 2025.<\/p>\n Want more?<\/p>\n Authority Insights is more than a newsletter \u2014 it\u2019s the hub for all our best content. If you care about Android, you won\u2019t want to miss any of our other exclusive reports<\/a>.<\/p>\n Don\u2019t have time to read them all? Subscribe to our Authority Insights Podcast<\/a> to hear me and my co-host, C. Scott Brown, break down our top stories of the week.<\/p>\n This week\u2019s top Authority Insights\n<\/p>\n The future of open-source Android seems bleak\u2026\n<\/p>\n <\/p>\n Android 16 QPR1\u2019s source code is nowhere to be found, but Google swears it\u2019s coming<\/p>\n Related<\/p>\n Android\u2019s answer to Apple Health could be getting a glow up\n<\/p>\n <\/p>\n Health Connect will soon track your steps without needing another app<\/p>\n Related<\/p>\n Google Photos could soon get some nice album-related upgrades\n<\/p>\n <\/p>\n Google Photos could finally fix its annoying search limitation on shared photos<\/p>\n Related<\/p>\n Google Photos could soon get its best looking Material 3 Expressive changes to date<\/p>\n Related<\/p>\n Google wants you to spend more time with Gemini\n<\/p>\n <\/p>\n Here’s your first look at Gemini’s dedicated space for all creations<\/p>\n Related<\/p>\n Gemini’s improved home screen is coming soon, and it could get new tweaks<\/p>\n Related<\/p>\n Gemini Live’s camera sharing could soon work better with Google Maps<\/p>\n Related<\/p>\n Gemini’s handy multi-tasking trick is expanding to more Android phones<\/p>\n Related<\/p>\n The iOS-ification of Android continues\u2026in a good way\n<\/p>\n <\/p>\n Google could redesign Android\u2019s volume slider to be more like iOS<\/p>\n Related<\/p>\n Pixel phones might soon stream emergencies in real-time just like iPhones<\/p>\n Related<\/p>\n More\u2026\n<\/p>\n <\/p>\n Android\u2019s anti-theft protections will soon become less annoying thanks to your smartwatch<\/p>\n Related<\/p>\n Google Tasks may be getting an upgrade that makes it worthy as a standalone app<\/p>\n Related<\/p>\n Google is working on making it easier than ever to find your Call Notes<\/p>\n Related<\/p>\n Gmail may finally alert you when someone reacts to your Chat messages<\/p>\n Related<\/p>\n Other top stories\n<\/p>\n We\u2019ll miss you, Nova Launcher\n<\/p>\n <\/p>\n Nova Launcher is shutting down, and Android fans are heartbroken<\/p>\n Related<\/p>\n Nova Launcher’s demise is another death knell for the Android I remember<\/p>\n Related<\/p>\n Smart Launcher has a message for grieving Nova Launcher users<\/p>\n Related<\/p>\n Google needs to fix these Pixel 10 issues to maintain its momentum\n<\/p>\n <\/p>\n Google quietly hits pause on a brand-new Pixel 10 feature, and it’s for the best<\/p>\n Related<\/p>\n Google’s new Pixelsnap Ring Stand is stumbling out of the gate with early issues<\/p>\n Related<\/p>\n Our Pixel 10 Pro XL has also run into the infamous screen snow issue<\/p>\n Related<\/p>\n Google’s Pixels rocket back into the global top 5 premium smartphones<\/p>\n Related<\/p>\n Things that Android OEMs should copy from the iPhone 17\n<\/p>\n <\/p>\n iPhone 17 Pro’s triple 48MP cameras raise the bar for Android flagships<\/p>\n Related<\/p>\n Android could learn a thing or two from iPhone 17’s selfie camera game<\/p>\n Related<\/p>\n Samsung wants to get ahead of the iPhone Fold with its own ‘Wide Fold’<\/p>\n Related<\/p>\n Don\u2019t miss out on these deals!\n<\/p>\n <\/p>\n YouTube TV is offering a hidden $66 discount \u2014 here’s how to get it<\/p>\n Related<\/p>\n![\"android](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/09\/android-system-security-updates-vs-play-system-updates-2.jpg\"\/ "\\"android")
<\/p>\n![\"Timeline](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/09\/Timeline-of-a-hypothetical-hisk-risk-Android-security-vulnerability.png\"\/ "\\"Timeline")
<\/p>\n
\nOEMs have more flexibility in deciding how quickly they want to release security updates. Most can focus their efforts on larger quarterly releases, while others can optionally update monthly to meet specific compliance targets.<\/p>\n![\"Timeline](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/09\/Timeline-of-a-hypothetical-low-risk-Android-security-vulnerability.png\"\/ "\\"Timeline")
<\/p>\n![\"Android](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/09\/1757530629_Android_figures_standing_around_Pixel_phone_with_AOSP_home_page_showing-scaled.jpg\"\/ "\\"Android")
<\/a><\/p>\n![\"android](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/09\/android-health-connect.jpg\"\/ "\\"android")
<\/a><\/p>\n![\"Gogole](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/08\/Gogole-photos-logo-on-smartphone-next-to-other-devices-and-picture-frame-Stock-photo-6.jpg\"\/ "\\"Google"){kind=logo}
<\/a><\/p>\n![\"google](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/09\/google-photos-app-icon-logo-google-pixel-5-2.jpg\"\/ "\\"google"){kind=icon}
<\/a><\/p>\n![\"Veo](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/09\/Veo-2-in-Gemini-on-an-Android-phone-scaled.jpg\"\/ "\\"Veo")
<\/a><\/p>\n![\"Samsung](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/09\/Samsung-Galaxy-Flip-7-with-Gemini-app-open-on-cover-screen.jpg\"\/ "\\"Samsung")
<\/a><\/p>\n![\"Gemini](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/09\/Gemini-Live-Pixel-10-Pro-XL-1.jpg\"\/ "\\"Gemini")
<\/a><\/p>\n![\"Gemini](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/09\/Gemini-Split-screen-Android.jpg\"\/ "\\"Gemini")
<\/a><\/p>\n![\"New](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/09\/New_volume_slider_UI_in_Android-scaled.jpg\"\/ "\\"New")
<\/a><\/p>\n![\"The](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/09\/google-pixel-10-pro-jade-back-7-scaled.jpg\"\/ "\\"google")
<\/a><\/p>\n![\"Identity](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/09\/Identity-Check-dialog-on-Android-phone-hero-image-scaled.jpg\"\/ "\\"Identity")
<\/a><\/p>\n![\"google](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/09\/google-tasks-feature-4.jpg\"\/ "\\"google")
<\/a><\/p>\n![\"Home](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/08\/google-phone-app-new-home-page-pixel-10-pro-scaled.jpg\"\/ "\\"google")
<\/a><\/p>\n![\"Gmail](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/09\/Gmail-on-Android-on-Google-Pixel.jpg\"\/)
<\/a><\/p>\n![\"Nova](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/09\/Nova-Launcher-Play-Store-scaled.jpg\"\/ "\\"Nova")
<\/a><\/p>\n![\"Nova](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/09\/Nova-Launcher-app-icon.jpg\"\/ "\\"Nova"){kind=icon}
<\/a><\/p>\n![\"An](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/09\/smart-launcher-6-hero-scaled.jpg\"\/ "\\"smart")
<\/a><\/p>\n![\"Daily](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/08\/google-pixel-10-pro-daily-hub-google-discover-watermark-scaled.jpg\"\/ "\\"google")
<\/a><\/p>\n![\"Google](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/08\/Google-Pixelsnap-Ring-Stand-attached-to-Pixel-and-standing-Pixel-upright.jpg\"\/ "\\"Google")
<\/a><\/p>\n![\"Google](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/09\/Google-Pixel-10-Pro-XL-facing-screen-snow-unresponsive-display-issue-scaled.jpg\"\/ "\\"Google")
<\/a><\/p>\n![\"google](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/08\/google-pixel-10-series-pro-xl-fold-family-1.jpg\"\/ "\\"google")
<\/a><\/p>\n![\"Apple](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/09\/Apple-iPhone-17-Pro-and-iPhone-17-Pro-Max-colors.jpg\"\/ "\\"Apple")
<\/a><\/p>\n![\"Apple](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/09\/Apple-Event-2025-iphone-17-air-frontie.jpg\"\/ "\\"Apple")
<\/a><\/p>\n![\"samsung](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/08\/samsung-galaxy-z-fold-7-open-in-hand.jpg\"\/ "\\"samsung")
<\/a><\/p>\n
![\"YouTube](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/09\/YouTube-TV-logo-on-smartphone-stock-photo-5.jpg\"\/ "\\"YouTube"){kind=logo}
<\/a>![\"Google](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/09\/Google-Pixel-10-lying-on-desk.jpg\"\/ "\\"Google")
<\/a><\/p>\n