You consider yourself a responsible smartphone user. You go out of your way to keep your data safe, protecting your handset with a strong passcode, paying close attention to the permissions you grant apps, and making sure that your phone is always running the latest security updates available to it. At least, you think your phone is patched against the most recent security exploits, but is it really? A new report suggests that's likely not the case, claiming that many phones are missing at least one, and sometimes ten or more security patches.

Security Research Labs looked into state of updates for some 1,200 phones from a variety of major manufacturers, and found that despite these handsets claiming that their software is caught up with Android security patches as of certain dates, one or more fixes were often missing.

Some manufacturers tend to do a lot better than others. Unsurprisingly, Pixel phones are the best, accurately indicating that they're up to date with security fixes, and devices from Samsung and Sony aren't far behind, maybe only missing one fix out of a larger batch. But that number starts creeping up higher as we look at hardware from LG, HTC, Motorola, and ZTE — the latter's phones averaging four or more absent patches.

Why wouldn't a company deliver all the fixes we'd expect it to? One theory points to the chipsets these handsets are running, as there seems to be a correlation between particular SoCs and the availability of security updates: Snapdragon-basedphones and those running Samsung's Exynos chipsmay only have one recent fix missing, while those built with MediaTek chips average nearly ten. And if a company making those chips isn't keeping up with patches, it becomes quite difficult for the manufacturers of the phones running them to fully secure their devices.

That all said, it's not necessarily a disaster that your phone might not have every single last possible security patch installed, and it often takes more than one unpatched bug to leave your phone open and vulnerable to attackers. The good news is that Android's underlying security architecture does its best to mitigate the impact of malicious actors, and even if your OEM skipped one or two patches, so long as it's caught up with the bulk of them, you're probably in good shape.
http://www.abilityworlds.com/2018/04/you-consider-yourself-responsible.html?m=1