1.5B Android users face risks on unsupported phones
Over 1.5 billion Android smartphone users are currently operating devices that no longer receive crucial security updates, leaving them exposed to known cyberattacks. That figure represents a substantial chunk of the estimated 3.9 billion active Android users worldwide, and it keeps growing as manufacturers and Google wind down support for older OS versions.

As of August 2026, only 56.7 percent of Android phones were running a supported OS version, Android 14 or later, according to StatCounter.com data. Google officially ended support for Android 13 in March 2026, pushing anyone still on that version or older into unpatched territory.

Flagship Phones Are Aging Out Too

This isn’t just a problem for people holding onto ancient hardware. Even recent flagship devices are approaching their expiration dates.

  • The Google Pixel 6 and Pixel 6 Pro lose support on October 1, 2026
  • Fairphone 3 and 3+ end security updates on September 30
  • Samsung’s Galaxy S22, S22+, and Ultra series stop receiving updates on February 25, 2027, just five months out
  • Several other Samsung devices, including the S21 FE 5G and various budget models, reach end of life even sooner

Apple takes a different approach here. Seven year old iPhone 11 devices are currently running the latest iOS 27, and even the older iPhone XR, XS, and Max models only lost support four months ago, well past what most Android manufacturers offer.

Why an Unpatched Phone Is a Real Target

Unpatched vulnerabilities can lead to full device compromise, and the tools available to exploit them keep getting sharper. Cybercriminals increasingly use generative AI to build and deploy exploits against known flaws, shrinking the time between a vulnerability being discovered and it being actively weaponized.

Multiple critical remote code execution vulnerabilities have surfaced in recent years, and some require no user interaction at all to trigger. Every phone still running an unsupported OS adds to the pool of devices these exploits can reach.

Hashlytics Take

The 1.5 billion figure sounds like a single crisis, but it isn’t one. A five year old budget Android phone with no security patches is a fundamentally different risk than a Galaxy S22 that still has months of support left. What actually matters is which specific device someone owns and how far past its end of life date it is, not the aggregate headline number. If you’re still on Android 13 or older, check your model’s support timeline directly rather than assuming the global statistic tells you anything about your own exposure.

Follow Hashlytics on Bluesky, Facebook, LinkedIn , Telegram and X to Get Instant Updates

RELATED ARTICLESMORE FROM AUTHOR