Android Security Updates: Is Your Phone Still Covered?

Your Android phone still feels fine. The battery lasts the day, the camera is sharp, and you see no reason to spend money on a new one. Then Google publishes a fix for a bug that lets an attacker run code on your phone without you tapping anything, and you find out your model will never get it.

That is the position Pixel 6 and Pixel 6 Pro owners landed in this month. Their last Android security update arrived in October. The November bulletin, which patches a critical zero-click flaw in Android 14 through 17, came a few weeks too late for them. And with Black Friday sales about to push cheap older phones at you, the same trap is waiting for anyone who buys a discounted model with only months of support left.

This guide shows you how to read your phone's patch level, why two phones on the "same" update can carry different fixes, and how to price a phone by the months of protection it still has, not by its sticker.

What the November Android Security Update Fixes

Google's Android Security Bulletin for November went out on November 2 and lists 215 vulnerabilities. The bulletin calls its most severe issue a critical flaw in the Framework component "that could lead to remote code execution with no additional execution privileges needed." It adds that user interaction is not needed for exploitation.

Framework is the layer of Android that apps and system services talk through. A remote code execution bug there means someone who gets crafted data onto your phone may run their own code on it, without you opening a link or installing an app.

The bulletin does not say anyone is exploiting the flaw yet. That good news is temporary: once a fix is public, attackers can compare patched and unpatched code to see what changed. The window between a published fix and working attacks is where unpatched phones are most exposed.

Which Android versions are affected

The headline Framework bug affects Android 14, 15, 16 and 17. If your phone runs Android 13 or older, you are not safe by default. It usually means the phone stopped getting updates long ago and is carrying older unfixed bugs instead.

Your Patch Level Tells You More Than Your Android Version

Most people check the Android version number and stop. The number you actually want is the security patch level, a date that shows which bulletin your phone has caught up to.

On a Pixel, open Settings, then About phone, then Android version, and look for "Android security update." On a Samsung Galaxy, go to Settings, then About phone, then Software information, and read "Android security patch level." To pull a pending update, Google's Pixel help page points you to Settings, then System, then Software update.

Why November 1 and November 5 are not the same update

Google splits each bulletin into two patch levels. This is the part most owners never notice.

• November 1 patch level: covers 118 flaws in the Android runtime, Framework and System components. The headline zero-click bug sits here.
• November 5 patch level: covers everything above plus 97 more flaws in the Linux kernel and in parts supplied by Arm, Imagination Technologies, MediaTek, Unisoc and Qualcomm.

The split exists because phone makers depend on chip vendors to deliver their part of the fix. A manufacturer can ship the November 1 level while still waiting on a modem or graphics driver patch. Your phone will say "November," yet nearly half the month's fixes may be missing. Google's bulletin says outright that it encourages partners to fix all issues and use the latest patch level, which tells you not all of them do.

Why Your Android Phone Gets Fixes Late, or Never

Google writes the fix. Your phone maker decides when you see it. Three separate clocks control that, and each one can leave you exposed for weeks or years.

Clock one: the rollout

Even Pixels, which come straight from Google, get updates in stages. Google's Pixel update help page says an update "may take a few weeks" to arrive and depends on your carrier and device. Carrier-sold phones often trail the rest because the carrier tests the build first.

Clock two: the schedule your model is on

Samsung publishes which phones get monthly patches and which get them less often. Its security update scope page lists the Galaxy S23, S24, S25 and S26 series on the monthly schedule. Most consumer Galaxy A phones, from the A14 through the A18 and the A33 through the A37, sit on the quarterly list.

Quarterly means a flaw Google patched in November may reach a Galaxy A16 in a later quarterly bundle. The same page notes that some carriers offer only quarterly updates even for current models, and that timing varies by market. If you bought a budget phone to save money, the hidden cost is longer gaps between fixes.

Clock three: the end of support

Every phone has a cutoff. Google's help page lists the Pixel 6, 6a, 7 and 7a at five years of OS and security updates, counted from when each first went on sale in the US Google Store. The Pixel 8 and every model since get seven years. Samsung says it extended security support for Galaxy devices "by up to 7 years," with the word "up" carrying a lot of weight across its range.

The Pixel 6 first went on sale in October five years ago, so its clock ran out with the October update. That phone runs Android 17, which sits inside the range of the November zero-click bug. It will keep working, but every fix from November onward will pass it by.

Price a Black Friday Phone by Its Months of Updates

Black Friday lands on November 27, and older models will be the loudest discounts. An older flagship at half its launch price looks like the smartest buy on the page. Often it has less than a year of protection left.

The fix is one line of math: price divided by months of security updates remaining. That gives you a cost per protected month you can compare across any two phones.

A worked example

Say you see these two sale prices on Black Friday. The prices are illustrative; the support dates come from Google's published policy.

• Pixel 7 at $199. It went on sale in October four years ago with a five-year promise, so its updates end next October. That leaves about 11 months. $199 divided by 11 is roughly $18.09 per protected month.
• Pixel 9a at $349. It went on sale in April of last year with a seven-year promise. Bought on Black Friday, it has about 64 months of updates left. $349 divided by 64 is roughly $5.45 per protected month.

The phone that costs $150 more is over three times cheaper per month of coverage. Buy the Pixel 7 and you will be shopping again next fall.

You can stretch the math further. If you plan to keep a phone four years, any model with fewer than 48 months of updates left will spend part of your ownership unpatched. Our guide on whether you should upgrade your phone right now walks through the other half of that decision: battery, storage and performance.

Rule of thumb: before you buy any discounted Android phone, search "[model] end of support" and confirm the month. If the seller cannot tell you, assume the worst.

What to Do If Your Phone Has Stopped Getting Updates

An unsupported phone does not stop working on a set day. Its risk climbs slowly as each month's unfixed bugs pile up. You have more options than "buy a new phone tonight."

1. Check your patch level first. If it reads October or earlier and your maker has confirmed end of support, nothing more is coming.
2. Keep Google Play system updates current. Some fixes ship through Google Play system updates rather than the full firmware, and the November bulletin lists several that repeat that way. On a Pixel, look under Settings, then Security and privacy, then System and updates.
3. Move sensitive tasks off the phone. Banking, work email and your password manager carry the most value. Use them on a supported device until you replace the old one.
4. Turn it into a single-purpose device. An old phone on home Wi-Fi as a music player, kitchen timer or baby monitor carries far less exposure than one holding your accounts.
5. Time your replacement. If support ends in a few months, a holiday sale is a sensible moment to switch, as long as the new phone passes the cost-per-month test above.

iPhone owners face a different version of the same problem, since Apple does not publish fixed support windows. Our breakdown of the DarkSword iPhone hack and how to stay safe covers what to check on that side. And if longevity is your goal, replaceable phone batteries only pay off on a phone whose updates outlast the battery.

Frequently Asked Questions

How do I check if my Android phone has the latest security update?

Open Settings, then About phone, and look for the Android security update or security patch level date. On a Pixel it sits under Android version; on a Galaxy it sits under Software information. A date of November 5 or later means you have every fix in this month's bulletin.

Is it safe to use a phone that no longer gets security updates?

It works, but it gets riskier every month as new flaws are published and never fixed on your model. For calls, music or a smart home remote, the risk is modest. For banking, email and passwords, move those to a supported phone.

How long does Samsung give security updates?

Samsung says it extended security support for Galaxy devices by up to seven years, with timing that varies by market, carrier and model. Its flagship Galaxy S phones get monthly patches, while most Galaxy A phones get quarterly ones.

Why does my phone show the November 1 patch instead of November 5?

Your maker shipped the first half of the bulletin, which covers Android's own code, but not yet the kernel and chip vendor fixes. Check for updates again in a few weeks. If the later date never arrives, those 97 fixes may be held up by your phone's chip supplier.

The Number to Check Before You Buy

The November bulletin is a clean reminder that the most important spec on an Android phone does not appear on the box. A zero-click flaw in Android 14 through 17 is fixed for phones that are still supported and permanent for those that are not. Pixel 6 owners missed it by a single month.

Before you open your wallet on Black Friday, check two things: your current phone's patch level, and the end-of-support month of anything you plan to buy. Divide the price by the months left. The phone that wins that math is the one still getting fixes when the next critical bug lands, and there is always a next one.