Major updates of Android don't matter as much as they used to. Many components of the operating system are updated through the Play Store, so even if you're on Android 8 or 9, you can still access most of the same apps and features as someone on the latest release of Android 10. However, the security updates that Google releases on a monthly basis are still critical to keeping your phone or tablet safe. Dozens of security flaws are discovered in components of Android each month, which is why Google releases monthly security patches.
However, unlike app and API updates, the security patches can't be delivered directly to devices — phone manufacturers have to integrate the changes into their own flavors of Android, and release them as system updates.
It's common knowledge that some companies are better than others when it comes to patching their phones, but making direct comparisons is somewhat difficult. It's hard to track down information about when exactly updates are released, so news coverage often relies on device owners seeing the update themselves. Carriers and slow rollouts only make matters more complicated.
The good news is that we've done all the hard work for you. This is our ultimate security update tracker, where we're giving each recent flagship phone a simple score from 1-10, based on how long it takes for security updates to get from Google to device owners.
We've updated the tracker with rollout data from the March 2020 patch. We've also added two new phones: the Asus ROG Phone II and OnePlus 7T Pro. The Galaxy S20 will likely be included starting next month.
How we score devices
If you're interested how we gather this data and assess it, we explain our methodology more on the second page. Here's the short version:
- We compiled a list of dates for security patches for each major 2019 Android flagship, starting from January 2019 or when the phone was released in the United States (whichever was earliest).
- The date for each security update is the first evidence we could find of a public rollout, either from an official announcement from the device maker, news coverage of the update, or confirmed reports from social media (whichever was earliest).
- Each device's score is calculated using a weighted average of the number of days between a security update's availability and the device's OTA being released, the resulting "score" being normalized into a number out of 10, and then a standard penalty being assessed for any given monthly update that is missed subtracting from that score.
Google Pixel 3/4: 10.0
It shouldn't come as a surprise that Google's flagships get perfect scores. Ever since the days of Nexus phones, Google has released security updates for its devices at the same time as the official security bulletins, effectively giving Pixel phones day-one updates. Furthermore, Pixel phones are the only devices we've tracked that didn't miss a single month.
There are a few instances where a security bulletin comes out a day or two before the Pixels get their updates, and vice-versa, but on average the delay is still zero days. If reliable and frequent security updates are your main concern when buying a phone, no other Android device comes close to matching the record of Pixel devices. Well, except for the Essential Phone, but those days are over.
Samsung Galaxy S10: 8.0
While Samsung has done a well enough job of keeping its flagship smartphones up to date with the latest security patches — the Galaxy S7 is still receiving quarterly fixes — the company improved its schedule slightly with the Galaxy S10. Not only has the S10 received security updates in a timely manner, but it was also among the first phones to receive an update to Android 10.
The Galaxy S10 has only missed two security updates since its release in early 2019: the patches for June and July 2019 were included in an August update. However, the S10's average 13-day delay from when Google's security bulletins were published is the main reason it fell behind other devices. That's not a ridiculous timeline, since updates usually still rolled out before the month was over, but still worth noting.
Nokia 9 PureView: 7.5
The Nokia 9 PureView is the closest thing HMD Global had to a flagship Android device in 2019 (Nokia's product lines have a lot of overlap), and even though the phone suffered from camera and fingerprint reader bugs when it launched, the PureView's security update record has been very good.
According to our data, the PureView has only skipped one month since its release. The May 2019 patch was never rolled out (Nokia combined it with the June patches), but that's the only exception so far.
The Nokia 9 PureView also had an acceptable average delay in updates, at just 14 days. While there were a few instances of Nokia rolling out the update in the first week of the month, most patches were released around two weeks later. For example, the February 2020 update rolled out on February 24th, the December 2019 patches were released on December 31st, and so on.
Asus Zenfone 6: 5.5
I certainly didn't expect an Asus phone to be in the top half of this list, but I have to give credit where credit's due. Even though 5.5/10 isn't an incredible score, it does narrowly beat out devices that are often perceived as providing more frequent updates, like the OnePlus 7 Pro.
The Zenfone 6 was something of a turning point for Asus' mobile division when it was released last year. It great device in its own right, as we highlighted in our review, but Asus also made frequent updates a higher priority. However, the phone has missed three months to date, with an average delay of 27 days.
Sony Xperia 1: 5.5
Since its US release in early 2019, Sony's Xperia 1 has skipped seven months of security updates. In general, updates were delivered on a bi-monthly basis, but the phone did go three months without an update during one period. The July and August 2019 patches were skipped, but the phone finally was updated in September.
However, the Xperia 1 has been much more consistent over the past six months or so, receiving bi-monthly updates with an average delay of 13 days. That low average is the main reason the Xperia 1 scored above devices with more frequent updates.
OnePlus 7T Pro: 5.0
OnePlus is typically praised for its quick updates, so the 5/10 score for the company's final 2019 flagship might come as a surprise to many of you. However, as the old saying goes, the data doesn't lie.
The OnePlus 7T Pro has skipped four months of updates since its release, and had an average delay of 29 days in receiving security patches. In fairness, the 7T Pro was released only a few months before the coronavirus outbreak in China, where OnePlus and other Chinese OEMs had to work at limited capacity. The 7T Pro didn't get its January security update until February 14th, for example.
OnePlus does have an Open Beta program where device owners can receive updates (including security patches) before they are ready for prime time, but that can come with bugs and other consequences.
OnePlus 7 Pro: 5.0
The OnePlus 7 Pro has been available since mid-2019, but for the moment, it gets the same 5/10 score as the newer 7T Pro. It has missed 4 months of updates since its release, and had an average update delay of 29 days.
However, OnePlus sometimes made up for the skipped updates by pushing the next one quickly. The phone didn't get a July 2019 update, but the August patch was delivered on July 31st — five days before the Pixel 3/4 got it.
LG G8 ThinQ: 3.0
I know this will come as a total shock to many of you, but LG is not good at updates. The G8 received security patches 34 days late on average, with a total of six skipped months since the phone was released.
However, there is one major caveat to our data on the G8: we're using rollout dates for the AT&T model, because there isn't enough public data about the US unlocked version. The added step of carrier approval could be adding some delay, but the frequency of patches is the G8's primary issue. There were no updates at all from late September until mid-February — and the February update only had the December patches!
Motorola Moto Z4: 3.0
Motorola has a known history of being extremely late with software updates, unless you happen to live in South America (where the company tends to focus its resources). As such, the Moto Z4's position in last place isn't much of a surprise, but the extent of Motorola's software support for its only flagship is a bit staggering.
The Moto Z4 had an average update delay of 39 days. However, it was more likely for Z4 owners to not get an update at all, as Motorola has skipped six months in total. The Z4's first update came in mid-July (containing May patches), then there were no updates at all until mid-November. Oh, and the November update was two months behind in security patches. Come on, guys.
Asus ROG Phone II: 0.0
Asus has offered frequent and quick updates for its main flagship, the ZenFone 6, but that same attention has not carried over to the company's current gaming phone. The ROG Phone II's security patch level has only been updated once since its release in August 2019 — as part of the device's Android 10 update.
Asus has updated the ROG Phone II's operating system a few other times — an August OTA included new lighting effects, and a November update fixed several bugs — but none of those seemingly included newer security patches. As a result, the ROG Phone II is the first phone to receive a zero on our scale.
We plan to keep this guide updated as each new month passes. See the second page for info on how we're dealing with things like regions, staged rollouts, calculating dates, and more methodological info.