After testing 1.2K Android phones from 2017, researchers find OEMs often don't install the security patches they claim to install; ZTE and TCL each omitted 4+
GOOGLE HAS LONG struggled with how best to get dozens of Android smartphone manufacturers—and hundreds of carriers—to regularly push out security-focused software updates.
Context & Ripple Effects
This finding lands at the end of a three-year paper trail. A study of 20,000 Android devices in late 2015 found 87% vulnerable because manufacturers weren't delivering patches; Android's own 2016 security report then conceded that half of devices in use had gone a year without a platform security update. Ars Technica had already diagnosed the cause: with dozens of OEMs and hundreds of carriers stacked between Google and the handset, the update strategy breaks down at scale.
What's new here is the integrity angle — researchers tested 1,200 phones from 2017 and found OEMs frequently don't install patches they claim to have installed, with ZTE and TCL each skipping four or more. That converts a delivery-gap story into a verification problem for Google, which within weeks responded by writing patching requirements into its OEM agreements.
First-order effects
- Buyers of ZTE and TCL handsets face a concrete trust gap: the patch level their phone reports can no longer be taken as accurate, since both vendors omitted four or more claimed patches.
- Google's patch-verification assumption is broken — the monthly security bulletin only works if OEMs apply what they attest to applying.
Second-order effects
- Google's move to embed patching requirements in OEM contracts shifts enforcement from voluntary cooperation to contractual obligation, giving it leverage over laggard manufacturers like ZTE and TCL.
- The finding compounds earlier Kryptowire work showing that Asus, LG, Essential, and ZTE firmware tweaks carry serious vulnerabilities — pushing US carriers and buyers toward vendors with cleaner update records when sourcing devices.
Third-order effects
- If attested-but-skipped patches prove widespread, Android's security model drifts toward audit and certification regimes — Google verifying claims rather than trusting them — reshaping how OEMs are ranked and approved.
- Persistent patch failure across the long tail of manufacturers strengthens the case that only vertically integrated players (or Google itself, via Project Treble-style decoupling) can guarantee device security over a handset's life.
The trend: Android security is migrating from a trust-based OEM patch pipeline toward contractually enforced and independently verified update obligations.