Google stops providing security patches for pre-KitKat WebView, leaves 930M users vulnerable
Google No Longer Provides Patches for WebView Jelly Bean and Prior — Over the past year, independent researcher Rafay Baloch (of “Rafay's Hacking Articles") and Rapid7's Joe Vennix …
Context & Ripple Effects
Researchers Rafay Baloch and Rapid7's Joe Vennix have been probing the aging WebView component, and Google's response is to stop shipping fixes for it entirely on Jelly Bean and earlier — a decision that strands roughly 930M devices running the embedded browser engine. It sits awkwardly against Google's own track record elsewhere in the stack, where it has kept patching at scale, including 115 Stagefright-related Android flaw fixes issued in the year after that bug went public.
First-order effects
- Around 930M users on pre-KitKat Android lose the safety net for WebView vulnerabilities, and every app that renders web content through the component inherits that exposure.
- Security teams and app developers building on older devices must now treat WebView as an unpatchable surface rather than a maintained platform component.
Second-order effects
- Google faces mounting disclosure pressure from independent researchers like Baloch and Vennix, whose findings will keep landing publicly even without official patches.
- Device makers and carriers still shipping Jelly Bean-era builds absorb the reputational cost of the gap, since the abandonment maps directly onto their installed bases.
Third-order effects
- If the pattern holds — patching the current fleet while letting legacy versions rot — Android's long tail becomes a structurally permanent vulnerability reservoir, pushing enterprises and buyers toward hardware refresh cycles as the only real fix.
- Component-level abandonment like this strengthens the case for decoupling critical libraries from OS versions so security updates no longer depend on the device's Android build.
The trend: Android security is bifurcating into a well-patched current fleet and an abandoned legacy tail, with Google's patch cadence defining which half a device lives in.