How Android Gets Security Updates in 2026: Project Mainline, Google Play System Updates and Patch Levels

Android phones get security fixes through three channels. Monthly security updates come from your phone's maker and fix vulnerabilities listed in Google's Android Security Bulletin. Google Play system updates, the result of Project Mainline, which started with Android 10 in 2019, let Google update core parts of Android directly through Google Play, without waiting for the maker. And app updates through the Play Store cover Google Play services, Chrome and WebView. To check yours, open Settings and look for Security & privacy then System & updates, or Software update, depending on the brand. There you will find the Security update date and the Google Play system update date. Both should be no more than a few months old. If your phone no longer gets security updates, Mainline still patches some components, but not all of them, and it may be time to replace the phone.

Ethan's father uses an older Android phone and asked whether it was still "safe". Ethan checked Settings, About phone, and found the Android security update date: more than two years old. Then he found a separate line, Google Play system update, dated last month. He was confused, since one said the phone was ancient and the other said it was current, so he called Jake. Jake explained that the two dates come from different places. The security update comes from the phone's maker, which had stopped supporting the model. The Google Play system update comes from Google directly and keeps patching some core components regardless. That is better than nothing, but not a full replacement. They looked at the maker's support policy, confirmed the phone was out of support, and planned a replacement with a long update commitment. This page explains how Android security updates work in 2026, what Project Mainline does and does not cover, how to check and install each kind of update, how long phones are supported, and what to do with a phone that no longer gets updates.

Why Android updates used to be so slow

Android is open source, and phone makers take Google's code, add their own changes, drivers and apps, and build their own versions for each phone. For years, every fix to Android's core had to travel that whole path: Google fixed the code, each phone maker merged the fix into its own version, tested it on every model, and sometimes mobile carriers tested it again before it reached your phone. Each step added weeks or months, and many older or cheaper phones never received fixes at all.

Google attacked the problem in stages. Project Treble, introduced with Android 8 Oreo in 2017, separated Android's core from the hardware-specific parts, making it easier for makers to update phones. Monthly Android Security Bulletins gave makers a regular rhythm and told users what was being fixed. And Project Mainline, introduced with Android 10 in 2019 and the subject of the original version of this page, went further: it turned important parts of Android into modules that Google can update itself, through Google Play, on phones from any maker.

Together with longer support commitments from the major brands, these changes mean that a phone bought today gets security fixes faster and for longer than at any time in Android's history. The catch is that the system now has several moving parts, which is why it can be confusing to tell whether a phone is up to date.

A short timeline of Android update changes

Each change chipped away at the old delays, and together they explain why a new phone in 2026 can expect years of timely fixes, while a phone from 2018 probably stopped receiving them long ago.

Stagefright: the bug that changed Android updates

The modern update system traces back to a 2015 discovery called Stagefright, a set of vulnerabilities in Android's media library that could, in principle, let a specially crafted video message compromise a phone, on hundreds of millions of devices. The fix existed quickly, but getting it onto phones exposed how slow the old update path was, with many phones never receiving it.

The response shaped everything since. Google began publishing monthly security bulletins, and major makers committed to monthly or regular security updates. Media handling was redesigned to be more isolated, and later became one of the first Mainline modules, so that fixes to media code could reach phones directly through Google Play. When people ask why media components are updated through Play today, Stagefright is the reason.

The three ways Android phones get security fixes

The monthly security update is the most complete: it can fix anything in the phone's software, including the Linux kernel and the maker's own drivers. It depends entirely on the maker continuing to support the model. The Google Play system update bypasses the maker for the components that are Mainline modules, so it keeps arriving even on some phones the maker has stopped updating, though it cannot fix everything. App updates cover a large part of what attackers target, such as the web browser engine, and arrive automatically through the Play Store on almost any phone with Google services.

A phone is in good shape when all three are current. A phone with a recent Google Play system update but an old security update, like Ethan's father's, is partly protected but has known holes that only the maker could fix.

It also helps to know which channel fixes what kind of headline. News about a flaw in Chrome or in the web view that apps use to show web pages is fixed by app updates from the Play Store, usually within days, on almost every phone. News about a flaw in media handling or networking may be fixed by a Google Play system update. News about a flaw in a chip maker's driver or the kernel needs the phone maker's security update, which is where support length matters most.

Check your Android security update status

1. Open Settings.
2. On Pixel and many recent phones, go to Security & privacy, then System & updates. On Samsung Galaxy phones, look under Security and privacy, then Updates, and for the main update, Software update. Other brands use similar names; searching Settings for "security update" finds it.
3. Note the Security update date, shown as a date such as September 5, 2026. This is the Android security patch level.
4. Note the Google Play system update date.
5. Tap each one to check for and install new updates.
6. Also open About phone, then Software information or Android version, to see your Android version.

A security update date within the last two or three months is good; up to six months is acceptable for some brands with quarterly schedules; older than that means the phone is not receiving fixes, either because updates are waiting to be installed or because support has ended. A Google Play system update within the last few months is normal.

If the security update date is old but the check finds nothing new, the maker has probably stopped supporting the phone, or your carrier has delayed it. The maker's support page for your model usually states the end-of-support date.

Google Play Protect: the scanner that is always on

Alongside updates, Google Play Protect scans apps on Android phones with Google Play, both in the Play Store before you install them and on the phone afterward, including apps installed from outside the Play Store. It warns about or removes apps it identifies as harmful. Its checks are updated by Google through Google Play services, so they keep working even on phones whose security updates have ended.

Open the Play Store, tap your profile, then Play Protect, to see when it last scanned and to run a scan. Keep Scan apps with Play Protect turned on in its settings. If Play Protect warns about an app, uninstall it unless you are certain it is safe; warnings about apps installed from websites deserve particular attention.

Play Protect is not a substitute for security updates: it looks for harmful apps, while updates fix weaknesses in the phone's software that attackers could exploit through other routes, such as a malicious web page or file. Both together give the best protection.

Carriers and delayed updates

Phones sold by mobile carriers, especially in the United States, sometimes receive updates later than the same model bought unlocked, because the carrier tests and approves updates for its network. The delay has shrunk over the years, but a carrier phone can still trail by weeks for major updates. Security updates are generally faster than full Android version upgrades.

If your security update date lags behind what the maker's support page says the model should have, the carrier may be holding it. There is little you can do except wait or contact the carrier. When buying, an unlocked phone from the maker, or a phone sold by a carrier known for quick approvals, avoids the issue.

Project Mainline: what it is and what it covers

Project Mainline splits parts of Android into separately updatable modules, packaged in special formats that Google Play can install, much like apps but with system-level privileges. Google builds and tests each module once for all Android phones, so a fix to a module reaches phones from every brand in the same update, without each maker having to merge and test it.

The list of modules has grown with each Android version since Android 10. It includes components that attackers frequently target or that need regular fixes, such as media codecs and frameworks, which process images, audio and video from the internet; networking components such as the DNS resolver and connectivity features; the permission controller; Conscrypt, the cryptography library behind secure connections; and, on newer Android versions, the Android Runtime that runs apps, parts of Wi-Fi and Bluetooth, and more. Which modules your phone has depends on the Android version it shipped with and the maker's choices.

Mainline updates arrive as the Google Play system update, typically monthly, and some require a restart to apply, which the phone prompts you for. They work on phones with Google Play, which covers most Android phones outside mainland China.

What Mainline does not cover matters just as much: the Linux kernel, hardware drivers, the maker's own software and modifications, and Android components that are not modules. Fixes for those still need the maker's monthly security update. That is why Mainline is a powerful safety net, but not a replacement for a supported phone.

Mainline in 2019 and Mainline today

When Google announced Project Mainline in 2019, it started with roughly a dozen modules, focused on components such as media codecs, networking and permissions, and it worked only on phones launching with Android 10. Critics at the time wondered whether phone makers would accept Google updating parts of their software directly, and whether it would matter while phones still depended on makers for most fixes.

Seven years on, the answer is clear: the module list has grown with nearly every Android release, major makers ship phones with Mainline as standard, and Google Play system updates have become a routine monthly event on hundreds of millions of devices. It did not replace maker updates, as this page explains, but it shortened the time to fix for many of the most attacked components from months to weeks, and it keeps protecting phones late in their lives, which was the original promise.

The Android Security Bulletin and patch levels

Google publishes the Android Security Bulletin each month, listing the vulnerabilities fixed in Android and in components from chip makers, each with a severity rating. Fixes are grouped under patch levels, such as 2026-09-01 and 2026-09-05; a phone whose security update shows September 5, 2026 includes all fixes in that month's bulletin up to that level, plus all earlier ones.

Phone makers publish their own bulletins too, covering fixes for their software, and Google publishes a separate bulletin for Pixel phones. When a news story mentions an actively exploited Android vulnerability, checking which patch level fixes it, then comparing with your phone's security update date, tells you whether you are protected.

Patch levels are cumulative: you do not need every monthly update individually, since the latest one includes everything before it. A phone that skipped months because it was off or unused catches up fully with the next update it installs.

Security update versus Android version

Two numbers describe an Android phone's software, and they are often confused. The Android version, such as Android 16 or 17, is the major release, with its features and design. The security update or patch level, such as September 5, 2026, says how current the security fixes are. A phone can be on an older Android version yet have a recent patch level, if its maker still provides security updates for that version, and that phone is reasonably secure.

Makers often stop major version upgrades before they stop security updates, so a phone may stay on Android 15 or 16 while still receiving monthly patches. For security, the patch level date matters more than the version number. When a phone is both on an old version and has an old patch level, it is out of support.

How long Android phones get updates

Support length now varies enormously by brand and model, and it is the single most important number to check before buying an Android phone. Google's Pixel phones from the Pixel 8 onward come with seven years of Android version and security updates from launch. Samsung offers seven years for its flagship Galaxy S series from the Galaxy S24 onward, and long commitments for many mid-range models. Other major brands have extended their commitments too, often to four to six years for recent phones, while budget models and smaller brands may offer two or three years, or no clear promise at all.

Commitments are counted from the phone's launch, not from when you buy it, so a phone bought two years after release has two fewer years left. The maker's website lists the end date for each model, and that date is the real expiry date of the phone's security.

Android 17, released to Pixel phones on June 16, 2026, reached other brands' recent flagships over the following months; phones still within their support window receive it, or at least its security fixes, according to each maker's schedule.

Check support before you buy

The most effective security decision for an Android user happens at the store. Before buying, check how many years of security updates the specific model has left. The steps are simple.

1. Find the exact model name, not just the series.
2. Open the maker's official support or security updates page and find the model's end date for security updates and for Android version upgrades.
3. Note the model's launch date; a phone that has been on sale for two years has used two years of its window.
4. Compare the remaining years with how long you keep phones. Many people keep a phone three to five years.
5. Prefer models with at least four years remaining, and avoid models with no published update policy.
6. Check whether the model gets monthly or quarterly security updates, which makers often state on the same page.

A discounted older flagship can be a bargain if it still has years of support left, and a poor buy if its updates end soon. For Ethan's father, they chose a model with six years remaining, which should outlast his habit of keeping phones until they break.

Buying a used or refurbished Android phone

Used and refurbished phones are good value, but their update window has already been partly used. Before buying, check the model's end-of-support date on the maker's site, as above, and on the phone itself check the security update date and that updates are available, by tapping Check for update. A refurbished phone that has been sitting in a warehouse may need several updates on first setup, which is normal.

Also check that the phone has been reset and removed from the previous owner's Google account, since Factory Reset Protection will otherwise lock it after a reset. And check the network lock status if you plan to use a different carrier. A used flagship with three or more years of support left often beats a new budget phone with two.

Factory resets and patch levels

A factory reset erases your data and settings but does not roll back security updates: the phone keeps the latest system software it had installed, and the security update date stays the same. After a reset, Google Play system updates and app updates may need to download again during setup, so connect to Wi-Fi and give the phone some time, then check both dates.

Resetting is a common fix for phones that refuse to install updates because of corrupted data, but it should be a last step, after restarting, freeing storage and clearing the Play Store's cache. Back up photos, messages and app data first, through Google One backup or your maker's backup service.

Install updates and keep them coming

Most updates install automatically when the phone is on Wi-Fi and charging, but checking manually speeds them up. In the update settings described above, tap Security update or Software update and choose Check for update; tap Google Play system update to check for Mainline updates; and in the Play Store, open your profile, Manage apps & device, and Update all.

Restart when asked. Both maker updates and some Google Play system updates only take effect after a restart, and a phone that is never restarted can sit with downloaded but unapplied updates for weeks. A weekly restart is a good habit anyway.

Keep enough free storage for updates, since a full phone may fail to download them silently. Our guide to freeing up phone storage covers making room without deleting apps you need.

Updating on mobile data and limited plans

Large updates usually wait for Wi-Fi by default, which protects mobile data allowances but can leave phones of people who rarely use Wi-Fi far behind. If that describes someone in your family, check the update settings: many phones allow downloading system updates over mobile data, with a warning about size, and the Play Store's auto-update setting can be set to any network. Monthly security updates are usually modest in size; major Android version upgrades are much larger and are better left for Wi-Fi.

Public Wi-Fi in libraries or cafes works for updates too, since update downloads are signed and verified, so a hostile network cannot slip in a fake update. Plugging in to charge while updating avoids running the battery down during installation.

When your phone no longer gets security updates

An Android phone past its support date keeps working, and Mainline and app updates may continue for a while, but known vulnerabilities in the kernel, drivers and other non-module components remain unpatched forever. Attackers know this and target old phones, especially through malicious links, apps and messages.

If you must keep using an unsupported phone for a while, reduce the risk. Keep Google Play services, Chrome and WebView updated through the Play Store, since they receive fixes independently. Install apps only from the Play Store and be strict about permissions. Avoid sensitive tasks such as banking on it if you can, or at least use the bank's official app rather than the browser. Be extra wary of links in messages and email. And plan a replacement with a long support commitment.

When you replace it, wipe the old phone properly with a factory reset after backing up, and remove it from your Google account's device list. Our guide to what data your phone sends covers privacy settings worth reviewing on the new phone.

Lost or stolen phones

Updates protect a phone in your hand; for a lost or stolen phone, other tools matter. Make sure Find My Device is on, in Settings, Google, Find My Device, so you can locate, lock or erase the phone remotely. A screen lock with a PIN or pattern, not just a swipe, keeps your data protected until you can act, and recent Android versions add theft protection features that lock the phone if it detects being snatched.

In some countries, national systems can block stolen phones from working on any network; in India, the CEIR portal does this, as our guide to blocking a lost phone with CEIR explains. Change the passwords for important accounts after losing a phone, starting with your Google account.

Privacy settings that complement updates

Updates fix weaknesses; privacy settings limit what any app, or attacker, can reach in the first place. Review app permissions in Settings, Security & privacy, Privacy, Permission manager, and remove location, camera, microphone and contacts access from apps that do not need it. Recent Android versions show indicators when the camera or microphone is in use and offer one-time permissions, which are worth using.

Also check which apps can install other apps, under special app access, and keep that list short. Our guides to what data your phone sends and device fingerprinting cover the privacy side in depth.

Set up a parent's phone so updates just happen

Older relatives often decline update prompts because they worry about something changing, and their phones fall months behind. A few settings help updates happen with minimal fuss. In the Play Store, under Settings, Network preferences, set Auto-update apps to over Wi-Fi only, or over any network if their plan allows. In the phone's software update settings, turn on automatic download over Wi-Fi and, where offered, scheduled installation overnight.

Then show them what an update prompt looks like, so they recognize it as normal, and agree that a restart at night is fine. When you visit, check the two dates in Settings and install anything pending. Ethan now does exactly that for his father, and the phone has stayed within a month of current ever since.

A one-minute monthly phone check

Once a month, open Settings and check the two dates, Security update and Google Play system update, and tap each to install anything waiting. Open the Play Store and update all apps. Restart the phone. Glance at Play Protect's last scan. That is the whole routine, and it takes about a minute plus download time.

For a family, doing it for everyone's phones at the same time, such as the first Sunday of the month, turns it into a habit. Jake suggests writing each phone's support end date somewhere visible at home, so the replacement conversation happens before the phone becomes a risk, not after.

Tablets, TVs, watches and other Android devices

Android runs on more than phones, and update support varies even more on other devices. Tablets from major brands often follow the same policies as their phones, but cheaper tablets frequently get few updates. Android TV and Google TV devices receive updates on their own schedules, often less frequently; they are less exposed than phones, but keeping their apps updated still matters. Wear OS watches get updates from their makers and through Google Play, with support periods varying by brand.

Mainline modules and Play Store app updates reach many of these devices too, which provides a baseline. For devices that hold sensitive data or accounts, such as tablets used for banking or work, apply the same rule as for phones: check the support period before buying, and replace devices that no longer receive updates.

Work phones and Android Enterprise

Organizations that manage Android phones through Android Enterprise and mobile device management tools can see each phone's patch level, require a minimum security update date to access work email and apps, and sometimes schedule updates. If your work phone suddenly loses access to work apps, an outdated security patch level is a common reason; installing the pending update usually restores access.

For personal phones used for work through a work profile, the same applies: the organization can check the patch level and may require updates. Keeping the phone current avoids interruptions at inconvenient moments.

Google Play system update problems

The Google Play system update will not install or says it failed. Restart the phone and try again; check free storage; make sure the Play Store and Google Play services are updated; and try on a different Wi-Fi network. Some Mainline updates install in stages over several days.

The date never changes. Some phones receive Mainline updates less often, and the date shows the version of the module set, which may not change every month. If it is more than six months old on a supported phone, clear the Google Play Store app's cache in Settings, Apps, and check again.

An update asks for a restart repeatedly. Restart, then check again; if it continues, a module may be failing to apply, which usually resolves with the next update.

Is it safe? Yes. Google Play system updates come from Google through the Play Store's secure channel. Apps or websites offering "system update" downloads, outside Settings and the Play Store, are not genuine and should be avoided.

Fake update warnings and scams

Because people know updates matter, scammers imitate them. Web pages and pop-ups claiming "Your Android is out of date" or "Your phone is infected, install this update" are fake, and the apps they push are often malware or adware. Genuine Android updates never come from web pages or ads, and never ask you to install an app from outside the Play Store.

Real updates appear in two places only: the phone's own Settings, under software or security updates, and the Play Store for apps and Google Play system updates. If a web page claims your phone needs an update, close it and check Settings yourself. If you installed something from such a prompt, uninstall it and run a Play Protect scan.

How attackers use unpatched phones

Attacks on phones usually come through content the phone processes: a web page opened from a link, a message or email attachment, an image or video, or a malicious app. Vulnerabilities in the browser engine, media handling or the kernel can let such content run code or gain privileges. Security updates close those holes, which is why attackers concentrate on phones that have not received them.

Most people are not individually targeted; the risk is broad campaigns that send malicious links to many numbers, or apps that hide malware. Keeping the phone updated, installing apps only from the Play Store, and treating unexpected links with suspicion block the vast majority of these. Our guide to public Wi-Fi safety covers another common risk when traveling.

How this compares with iPhone updates

Apple controls both the hardware and software of iPhones, so iOS updates reach all supported iPhones at the same time, directly from Apple, without carriers or other makers in between. That has historically made iPhones faster to patch. On recent iOS versions, Apple can also deliver urgent security fixes between full updates, similar in spirit to Mainline.

The gap has narrowed. With Mainline, monthly bulletins and seven-year commitments on flagship Pixels and Galaxys, a current Android phone from a major brand is updated about as reliably as an iPhone. The difference that remains is in the wider market: many cheaper Android phones still get shorter, slower support, while every iPhone gets Apple's updates for several years.

Custom ROMs for unsupported phones

Some enthusiasts keep old phones updated by installing a custom ROM, a community-built version of Android that continues receiving Android's security fixes after the maker stops. This can extend a phone's life, but it involves unlocking the bootloader, which erases the phone and may affect warranties, banking apps and some features; drivers for older hardware may not receive fixes; and installation mistakes can make a phone unusable.

For technically confident users with a well-supported model, it can be a reasonable option. For most people, including Ethan's father, a phone with a long official support period is the safer and simpler path. If you do try a custom ROM, choose a well-established project with active maintenance for your exact model, and follow its instructions carefully.

Frequently asked questions

Android security in 2026 comes through three channels: the maker's monthly security updates, Google Play system updates powered by Project Mainline, and app updates through the Play Store. Check both dates in Settings, restart when asked, and know your phone's support end date, which can be seven years away on recent flagships or already passed on older and cheaper models. Mainline keeps patching core modules even late in a phone's life, but it cannot replace the maker's support. Ethan's father now has a phone with years of updates ahead, and Ethan checks both dates whenever he visits.

Revision note. Written October 3, 2026, updating our 2019 story on Project Mainline into a complete guide to how Android phones get security updates today. It covers why updates were slow, the three update channels, checking your status, what Mainline covers and does not, the Security Bulletin and patch levels, support lengths, installing updates, unsupported phones, troubleshooting and the iPhone comparison. May your patch level always be recent.