How Long Each Android Phone Maker Ships Security Updates

Shopping for a new Android phone? Chances are, one of your top concerns will be the length of time the manufacturer promises to keep it updated. Unfortunately, the term-by-term security update promises that phone makers publish don't actually compare meaningfully without digging in.

It's because the answer isn’t just a single number. It's split into two distinct clocks.

There is the number of years of full OS upgrades and there is the number of years of security patches. And when you buy a phone, only the security patch — on one specific screen inside the Settings app — has the latest meaningful information you want.

The promise, not the slogan

A phone's Android version is like operating system software. Updating it replaces the whole OS, and upgrades are often named like a new release — "Popsicle", "Tiramisu", or "Upside Down Cake". With each OS upgrade, the device may get new features, user interface changes, and a lot of enhanced functionality.

Meanwhile, security patches don't upgrade the whole OS. They just keep upgrading your phone's defenses against the latest security vulnerabilities, like they are little software antispam washers for your phone.

They're named after dates, and those are the patch levels you actually want to see in your Android settings.

One of the biggest differences between manufacturers is the length of time they promise full Android OS upgrades vs. security patches.

Google promises its Pixel line will get seven years of security updates. But the security updates are monthly, not quarterly. And they're distributed faster, even to the same hardware placed in handsets by other manufacturers.

That's why Samsung is giving the same seven years of security updates, but in comparison, support for the Samsung Galaxy won't get security patches as fast as Google's Pixel handsets. [4, 5]

Samsung still gives seven years of security patches, just like Google. [4, 5] Other brands fall down: Xiaomi and OnePlus give only six years. But you should look past year counts.

What the patch-level string means

For any Android device, the truth is in the one crucial string that gives you the date of the latest patch your device is using. [1, 2, 3, 8] This string — which lives in the settings, more on how to find it, below — isn't a numbered patch version. It’s a date string, like [2026-08-01]. [1, 3, 7] The string tells you which Google security bulletin the phone is topped off with. [1, 3, 7]

Google’s Android Security Bulletins are a monthly updated collection of security patches to protect your phone. [1, 2, 3, 7] Released once a month, by the date in the security patch level string, the latest security patches are applied to your phone. [1, 2, 3, 7]

That’s right — your patch level string is probably telling you your phone has the same patch level as other Android phones with the same string. [1, 3, 7] So just the patch level is actually the important thing. It’s more important than the phone maker’s big numbers.

The security patch level can't tell you whether your phone is getting full Android updates. It can't predict when the last patch will come. But when security really matters, the patch level is the crucial piece of information.

How to check the phone in your hand

No matter which manufacturer or model, it's important to check the security patch level of your own Android device. The exact path may vary by OS version, but typically:

-

• Pixel phone owners find the Android security update level under Settings > About phone > Android version
• Samsung Galaxy users go to Settings > About phone > Software Information
• OnePlus handsets show the Android security update level under Settings > About phone > Android Version

No matter what, all recent Android models will display a string like [2026-08-01] somewhere in that section. [1, 3, 7] Compare the patch date to today's month, or check the latest available bulletin on Google's security update page [1, 2, 3, 7]. That's the crucial indicator that your phone is on the most recent patch.

Where the market leaders stand

Putting the most recent scores for the leaderboard manufacturers side-by-side, here’s the current state of Google’s own scorecard for the tech names everyone knows:

• Google promises a whopping seven years of security updates across Pixel devices, distributed monthly to Pixel devices [4, 5]
• Samsung matches the seven years, but the Galaxy S25 receives monthly updates, though Pixel updates may arrive faster [4, 5]
• OnePlus 13 gets six years, as does Xiaomi 15

But it may be a false comfort to compare the leaders at all, because these tallies can only give the numbers.

It's because the clock for "seven years" could be measured from the phone's launch, first software release, or first retail sale. Smartphone makers don't standardize on a single method. It's all over the policy pages. [4, 5, 6, 8, 9, 10]

There is just no one authoritative chart that lines up all these brands on the same date or methodology. While Google scores all the current brands, [4, 5, 6] it can't be trusted to be the single source, or actually guarantee the numbers are compared fairly. [4, 5, 6]

The missing comparison problem

What worries you should worry me too, and it’s not the patch level's meaning.

It's that there's no authoritative source placing the whole market on the same footing. Maybe that's because there are a lot of Android vendors out there. In fact, most of the Android market doesn't get asked for the same security update promises.

Motorola, Sony, and Fairphone all have current phones with some stated security commitment — — but the details aren't equivalent to the top-tier Samsung, Google, or OnePlus promises. [4, 5, 6, 8, 9, 10]

As 2025 fades, what we don't have is one comparison, brand by brand, that tells us all the details. When you're checking a phone maker's audited security policy statements, you need to compare the same metrics even if the phone makers differ. [4, 5, 6, 8, 9, 10]

Conclusion

On a used or new phone, no matter the brand, the message from Google and Samsung also applies to Xiaomi, OnePlus, and every Android that checks in for security patches. Look at your device's patch level: a security patch level from less than 90 days ago means you should be getting the bulk of those patches. Compare that to the latest Android security bulletin from Google, which you can browse by month and year, and read it online. Explore Google Security Bulletins online by month and year on the google bulletin site. [1, 2, 3, 7].

Don't stop there. Check the release date for that patch, and check that its underneath the date in the security patch level string. Then note the date of this bulletin compared to the patch level on your device. That will tell you if your phone is running the latest patches.

And if you're buying a used phone? The patch level shows you that crucial date of the last package of patches you received. But you may be buying it too, because how much longer could you get updates once, or twice a year from now? Even if the patch string is there, those phones may be running on nothing more than "legacy"—a popular refrain, but a pained one when it comes to Android.

Smartphones changed things. But Android promises it can keep up—if you buy the phone with the patch string it shows, then check the patch level regularly after that. That is your assurance you are actually receiving support, and your best chance at keeping your phone secure for years to come.

Sources

• Android Open Source Project / source.android.com — source.android.com
• Gadget Hacks — android.gadgethacks.com