How Android Gets Security Updates Now (Project Mainline)
—
Project Mainline is the reason your Android phone can get a security fix without waiting for Samsung, Xiaomi, or Google to release a whole new software update. Google now pushes those patches straight through the Play Store, the same channel that updates your apps. The genuinely surprising part: this quietly launched back with Android 10 in 2019, and by now it patches dozens of core system pieces you have probably never restarted your phone for on purpose. If you have owned an Android phone since 2020, some of the most important security work protecting it happened with no visible update screen at all.
Jake runs the phone shop on the corner of his street, and about once a month a customer walks in convinced their two year old Android phone must be riddled with security holes because it has never once shown them a big software update. Jake used to just shrug and tell them to upgrade. Ethan finally set him straight over coffee.
Here is what is actually happening on that customer's phone, and on most Android phones sold since 2019.
What Project Mainline actually is
Project Mainline is Google's name for breaking pieces of the Android operating system into individually swappable modules, then updating those modules through the Play Store instead of through a full firmware update from the phone maker. Google first announced it in May 2019 alongside Android Q, which shipped that September as Android 10. The idea was simple even if the engineering behind it was not: stop waiting on Samsung, Xiaomi, OnePlus, and every other manufacturer to package, test, and push a security fix through their own update pipeline, which routinely took a month or longer, and sometimes never happened at all on cheaper phones. Instead, ship the fix the same way Google ships an app update, straight to the device, no manufacturer involved.
Android 10 launched with thirteen of these modules. Manufacturers were not required to include all of them, so adoption was patchy in that first year. Android 11 changed that: Google made twenty five modules mandatory for any device that wanted Google Mobile Services, meaning the Play Store, Gmail, and everything else that makes an Android phone useful outside China. That mandate is the real reason Mainline stuck. A phone maker cannot sell a phone with the Play Store on it and skip the modules.
By Android 13 the module count had more than doubled again, covering pieces like ART, the Android Runtime that actually executes your apps, media codecs, Bluetooth, Wi-Fi, permission handling, and the DNS resolver. Google has kept adding modules with nearly every release since, and as of Android 16 and 17 in 2026 the list covers dozens of components, though the exact number a given phone ships with still depends on which Android version it launched with and which modules its chipset supports.
You will most often see this called a Google Play system update rather than Project Mainline. That is Google's own consumer facing name for it, and it is what shows up in your settings. Project Mainline is the engineering project name; Google Play system update is the update itself landing on your phone.
Ethan's take
"This is the single most underrated thing Google has done for Android security, and almost nobody outside the Android press has heard of it. Everyone worries about which phone gets the fastest Android version updates. Almost nobody realizes that a huge share of the actual security work bypasses that whole argument entirely."
We first mentioned this project back when it was still a Google I/O announcement for an Android version that had not shipped yet. Seven years on, it is not a future promise anymore — it is running quietly on essentially every Android phone sold since 2019 with Google apps on it, and it has become the primary way Google patches the parts of Android it controls directly.
🕐 What changed since we first wrote this
- Then, in 2019: Project Mainline was an announced plan, limited to the then-upcoming Android Q, described as a future fix for update fragmentation.
- Now: it shipped as part of Android 10 that September, became mandatory across manufacturers with Android 11, and has grown from 13 modules to dozens covering ART, media, Bluetooth, Wi-Fi, and more through Android 16 and 17.
- What that means: the "one day" we mentioned back then already arrived — it just arrived quietly, as a settings screen almost nobody checks rather than an announcement.
How to check whether your phone is getting these updates
Every phone running Android 10 or later has this screen, regardless of manufacturer. The path is the same everywhere Google controls it: open Settings, tap About phone, tap Android version, and look for Google Play system update near the bottom. It shows the date of the last Mainline bundle installed, and on most phones a button to check for a new one manually.
Samsung moved this into its own security menu on recent One UI versions: Settings, then Security and privacy, then Updates, where Google Play system updates sit alongside Samsung's own monthly security patch. Other manufacturers with lighter customization, including most Pixel and Nothing phones, keep it in the plain About phone path.
🙋♂️ Jake's Reality Check
"So if this thing has been running on my customers' phones this whole time, why do half of them still act shocked when I tell them their two year old phone hasn't had a 'real' update in months?"
Because the two things look identical from the customer's side and are not the same thing. A full Android version update changes the visible interface and shows up as a headline event. A Google Play system update changes code underneath the interface and shows up, if it shows up at all, as a quiet date buried three menus deep in Settings.
Two things are worth knowing before you go looking. First, the date you see is not the same as your security patch level, which lives one menu item up under Android security update. They are usually close together but not guaranteed to match, and Google confirmed a cosmetic bug in early 2026 where some devices displayed a stale Mainline date even though the modules underneath had actually updated correctly. If your date looks suspiciously old, check the Android security update line first before assuming something is broken. Second, tapping "check for update" does not always find something new, because Mainline updates roll out gradually across Google's server infrastructure rather than to every device at once. A phone showing last month's date is not necessarily behind; it may just not be in this month's rollout wave yet.
⚠️ What this actually breaks
Do not confuse a recent Google Play system update date with a fully patched phone. Mainline only covers the modules Google packaged into it. Kernel level vulnerabilities, chipset driver bugs, and issues in code the manufacturer added still depend entirely on that manufacturer shipping a full security update. A phone can show this month's Google Play system update and still be running a kernel with a known, unpatched hole, because that hole simply is not Mainline's job to fix.
Why some phones still feel slower to update than others
This is the part that trips people up, and it is also the part of Jake's shop conversations that actually costs him customers. A customer buys a budget phone, hears that Google now patches security issues directly, and assumes every Android phone updates at the same pace. It does not, for a specific and explainable reason.
Mainline covers the pieces of Android that Google wrote and controls directly. It does not, and structurally cannot, cover the parts a chipset maker or phone manufacturer added on top: the camera stack tuning, the custom launcher, the vendor specific drivers that talk to the actual radio and sensor hardware, or the kernel itself. Those pieces still travel through each manufacturer's own release process, at whatever pace that manufacturer chooses to run it at. A flagship phone from a manufacturer with a dedicated software team might turn a full security update around in a couple of weeks. A budget phone from a smaller brand, or one running an older chipset the manufacturer has deprioritized, can still take the better part of two months — exactly the delay Mainline was built to route around for the pieces it actually covers.
A meaningful share of active Android devices in 2026 are running versions that no longer receive full security support at all, concentrated heavily on cheaper and older hardware. Those phones still get Mainline's Play Store delivered fixes as long as Google Play Services itself keeps working on them. What they do not get is anything requiring a manufacturer to touch the kernel or the vendor layer, because that support window closed when the manufacturer stopped shipping updates for that model.
✅ Why this is the one habit worth keeping
Never manually disable Play Store background updates or "auto update apps" as a battery saving trick. Mainline updates ride through the same Play Store mechanism, and turning that off to save a sliver of battery quietly turns off a meaningful chunk of your phone's security patching too. It is a bad trade.
What Mainline changed compared to before it existed
Before Android 10, a security researcher finding a bug in, say, the media framework meant a fix had to travel from Google, through every manufacturer's own build process, through carrier certification in some markets, before it reached a single phone. That pipeline realistically took a month at best, and on phones the manufacturer had stopped actively supporting, it often never completed the trip at all. Stagefright, the 2015 media playback vulnerability that briefly made national news, is the case study Google built Mainline specifically to prevent from happening again: a flaw sitting in exactly the kind of low level media code that took the industry the better part of a year to fully patch across the Android ecosystem at the time.
Mainline does not eliminate that slow pipeline. It routes a growing share of fixes around it entirely for the modules Google chose to modularize, while leaving everything else — kernel, drivers, manufacturer additions — exactly where it was. That is a real improvement and a partial one at the same time, worth understanding as both rather than as the complete fix the original 2019 announcement made it sound like it might become.
Frequently asked questions
What is Project Mainline?
Project Mainline is Google's system for updating specific parts of the Android operating system directly through the Play Store, instead of waiting for a full firmware update from the phone manufacturer. It launched with Android 10 in 2019.
Is Project Mainline the same thing as a Google Play system update?
Yes, for practical purposes. Project Mainline is the engineering project's internal name. Google Play system update is what the same thing is called in your phone's settings.
How do I check if my phone has gotten the latest Google Play system update?
Open Settings, tap About phone, tap Android version, and look for Google Play system update near the bottom of that screen.
Why does the Google Play system update date on my phone look old?
It can mean the update has not reached your device in the current rollout wave yet. It can also be a display issue; Google confirmed a cosmetic date display bug in early 2026 that showed stale dates on some devices despite the modules underneath being current. Check the separate Android security update line for a more reliable picture.
Does every Android phone get Mainline updates?
Any phone launched with Android 10 or later that includes Google Mobile Services, meaning the Play Store and related Google apps, is required to support the mandatory modules. Phones without Google apps do not receive them the same way.
What is the difference between a Google Play system update and a regular security update from my manufacturer?
A Google Play system update patches the modules Google controls directly, delivered on Google's timeline. A manufacturer security update patches everything else, including the kernel and vendor drivers, and travels through that manufacturer's own process, which can take substantially longer.
Can a Google Play system update fix every security vulnerability on my phone?
No. It only covers the modules included in Mainline. Kernel vulnerabilities and manufacturer or chipset specific code still require a full update from whoever made your phone.
Why does my phone still take weeks to get a full security update if Mainline is supposed to fix this?
Mainline speeds up the modules Google controls. It does not speed up the manufacturer's own process for the kernel, drivers, and any custom software they added, which is usually the actual source of the delay you're noticing.
Do I need to do anything to receive these updates?
No manual action is required in most cases. Keep automatic updates enabled in the Play Store, since Mainline updates travel through that same mechanism.
What if the "check for update" button doesn't find anything new?
That usually means your device is not yet in the current staged rollout for that update, rather than that something is broken.
Do tablets, Wear OS devices, and Android TV get Mainline updates too?
Yes. Google has extended Mainline delivered updates beyond phones to tablets, Wear OS, Android TV and Google TV, and Android Auto, on the same Play Store based mechanism.
What is APEX, and is it the same as Mainline?
APEX is a packaging format introduced alongside Mainline in Android 10 that lets some modules become active earlier in startup than a standard app package can. APEX is the container; Mainline is the overall project.
Does turning off "auto update apps" also turn off Mainline updates?
Largely yes, since Mainline updates are delivered through the same Play Store mechanism used for app updates.
How often does Google release new Google Play system updates?
Roughly monthly, generally aligned with Google's monthly Android security bulletin, though the exact rollout pace to any individual device depends on Google's staged release schedule.
Was Project Mainline ever limited to specific phone brands?
No. It was built to work identically across manufacturers precisely because manufacturer inconsistency was the problem it was designed to solve.
Revision note. Originally published May 8, 2019, when Project Mainline was a newly announced feature Google planned to ship with the then-upcoming Android Q. Google shipped it that September as Android 10, and it has run quietly on Android phones with Google apps ever since; what started as thirteen modules has grown release over release as Google has folded more of the operating system into it. If you came here after seeing an old, unfamiliar date on your phone's update screen, hopefully that number makes a lot more sense now, and a little less alarming.