Google recently announced a change to its Android security update strategy, introducing a "Risk-Based Security Update System" (RBUS). This system prioritizes patching high-risk vulnerabilities that are actively exploited or in known attack chains, while releasing all other vulnerabilities in quarterly updates. This change breaks with the decade-long tradition of monthly, full Android updates and marks a significant step forward for Google in improving security protection efficiency.
In the past, Android released monthly security bulletins, listing all vulnerabilities fixed that month, and provided private versions to device manufacturers (OEMs) 30 days in advance for testing. However, due to the complexity of the system, as well as OEM customization and carrier approval processes, many devices, especially mid-range and low-end models, often took two to three months to receive updates. By limiting monthly updates to high-risk vulnerabilities, the new policy significantly reduces the number of patches OEMs must process each month, alleviating the burden of testing and release.
Notably, the definition of high-risk vulnerabilities is based not only on "critical" or "high" ratings, but also on the actual threat level. This adjustment has already shown initial success: the July 2025 security bulletin included zero fixes for the first time, breaking the streak of 120 bulletins; and the September quarterly bulletin disclosed 119 vulnerabilities. Google encourages OEMs to maintain at least quarterly updates, while allowing some manufacturers to continue with monthly updates.
However, the privacy and security project GrapheneOS points out that disclosing quarterly updates to OEMs months in advance can increase the risk of vulnerability disclosure. Furthermore, Google's decision to no longer open-source its monthly updates makes it difficult for most custom ROMs to maintain a monthly update cadence. For users, the new policy will maintain the same user experience for devices that update monthly, while devices with less frequent updates can expect more consistent patch coverage. However, security protection will rely more heavily on centralized quarterly updates, and the industry must strike a balance between efficiency and risk.
