Android Alert: 1 billion smartphones are vulnerable; it’s time to replace them

A recent analysis based on distribution data provided by Google has revealed an alarming statistical reality for global security: around 40% of Android devices currently in circulation are exposed to new-generation malware and spyware attacks with no effective defense.

The figure, which translates into an estimate of one billion users affected, highlights a structural problem related to software obsolescence and to the fragmentation of updates.

Over 40% of users are carrying an insecure Android smartphone

The crux of the matter lies in the security updates policy. Google has halted the release of security patches for devices running Android 12 or earlier versions.

In practical terms, this means that smartphones released in 2021 or earlier are now unprotected against the latest cybersecurity threats.

Figures for December 2025 are grim: only 57.9% of devices are running Android 13 or later versions. Consequently, the remaining 42.1% of the global fleet is technically vulnerable.

It is an open door for malicious code capable of exploiting system flaws that will never be fixed.

The fragmentation numbers

The Achilles’ heel of the Android ecosystem remains the difficulty coordinating updates on a global scale. Unlike Apple, which controls both hardware and software, ensuring rapid diffusion of new versions (iOS 26 already installed on 50% of iPhones), Google has to interface with a miriad of third-party manufacturers.

This drastically slows the adoption of new builds, as shown by the low penetration of the latest Android 16, present on a negligible percentage of devices.

Here is the current situation, here are the supported and secure devices:

• Android 16: 7.5%
• Android 15: 19.3%
• Android 14: 17.2%
• Android 13: 13.9%

Here are the obsolete and at-risk devices:

• Android 12: 11.4%
• Android 11: 13.7%
• Android 10: 7.8%
• Android 9: 4.5%
• Android 8: 2.3%

The real risks and the necessary solution

For those with a phone stuck on Android 12, the situation requires immediate action. Google Play Protect still offers partial coverage supporting devices up to Android 7 through real-time scans and virus signature updates, but this is not sufficient to cover the OS’s deep vulnerabilities.

A company spokesperson confirmed that, while Play Protect helps, the lack of system patches is critical.

The biggest danger concerns sensitive data. A malware attack on an unpatched system could allow cybercriminals to steal bank credentials and passwords, with disastrous financial consequences.

The recommendation, coming directly from Mountain View, is unequivocal: it’s necessary to replace the device.

There’s no need to necessarily aim for an expensive top-of-the-line device; even a current mid-range model, as long as it can run Android 13 or higher, is enough to ensure the cybersecurity necessary. Obviously, the newer the smartphone and the more it will be supported, except for exceptional cases.

For that billion users still tied to older smartphones, hardware upgrading is now an essential precaution.