Google Warns: Over 1 Billion Android Devices Face Critical Security Risk

By Prowell Tech Research Team, February 11, 2026

Google has confirmed that more than 1 billion Android devices worldwide are now operating without critical security protection, leaving users vulnerable to malware, spyware, and banking trojans. This represents approximately 42% of all active Android phones globally.

In statements to multiple cybersecurity publications in early February 2026, Google confirmed that devices running Android 12 or older have reached end-of-life status and will no longer receive system-level security patches—a situation security experts are calling the “Android security dead zone.”

If you’re using an older Android phone, here’s everything you need to know about this massive security gap and how to protect yourself.

The Security Dead Zone: Understanding the Crisis

The core issue stems from Google’s software support lifecycle. On March 31, 2025, Google officially ended security patch support for Android 12 and Android 12L, meaning these devices have gone nearly a year without receiving fixes for newly discovered vulnerabilities.

The Numbers

According to Google’s latest distribution data (December 2025):

• Only 57.9% of active Android devices run Android 13 or newer
• 42.1% are running Android 12 or older—over 1 billion devices
• Android 16 (the latest) is on just 7.5% of devices
• Android 15: 19.3%
• Android 14: 17.2%
• Android 13: 13.9%

The most vulnerable versions still in widespread use:

• Android 12: 11.4% (no longer supported)
• Android 11: 13.7% (no longer supported)
• Android 10: 7.8% (no longer supported)

This means your phone might still work perfectly fine, but its security defenses have been dismantled.

Why the Urgency Now?

You might wonder: “My phone has been fine for years—why the concern now?”

The timing is critical due to documented escalations in mobile malware targeting older Android systems throughout 2025 and into 2026:

Confirmed Active Threats

Security researchers have identified multiple sophisticated malware campaigns specifically exploiting older Android kernels:

Albiriox (Sept 2025-present)

• Remote Access Trojan (RAT) and banking malware
• Sold as Malware-as-a-Service (MaaS)
• Targets hundreds of banking and cryptocurrency apps globally
• Performs on-device fraud, not just credential theft

FvncBot (Late 2025)

• Banking trojan targeting Poland and expanding
• Features keylogging, screen streaming, and hidden remote control
• Uses accessibility services to bypass security

Mobile threat statistics (Malwarebytes data):

• Android malware detections increased 151% in H1 2025
• Spyware detections surged 147%
• SMS-based malware spiked 692% between April-May 2025
• Banking Trojans and spyware now outpacing traditional adware

According to Kaspersky, nearly 143,000 malicious installation packages targeted Android in Q2 2025 alone, with 42,220 being banking trojans.

The Play Protect Misconception

Many users believe Google Play Protect provides adequate protection.

The Reality: While Play Protect does scan apps for malicious code (supporting devices back to Android 7), it cannot fix operating system vulnerabilities.

As a Google spokesperson confirmed to Forbes: “Google Play Protect, Android’s built-in malware and unwanted software protection, continues to support devices as far back as Android 7 to help keep users safe.”

However, Play Protect operates at the app layer. If hackers exploit a flaw in the Android 12 system itself—through a compromised website, zero-click exploit, or kernel vulnerability—Play Protect cannot stop them. It’s like having a security guard at the gate but no fence around the property.

Is Your Device Affected?

How to Check Your Android Version

1. Open Settings
2. Scroll to About Phone (or About Device)
3. Look for Android Version

What Your Version Means

Commonly Affected Devices

Devices that maxed out at Android 12 include:

• Samsung Galaxy S10, S10+, S10e, S10 5G series
• Google Pixel 3a and 3a XL
• OnePlus 7 and 7 Pro series
• Many mid-range phones from 2020-2021

The Samsung Galaxy S21 series officially reached end-of-life in February 2026.

The Solution: Upgrade or Replace

Google’s advice is unambiguous: If your device cannot run Android 13 or newer, you need a different phone.

This creates a dilemma for users attached to premium hardware, but in 2026, software security outweighs hardware capability.

What Security Experts Recommend

Don’t use unsupported phones for:

• Online banking or financial apps
• Cryptocurrency wallets
• Work email and sensitive business data
• Two-factor authentication
• Storing passwords or payment information

If you must keep the device:

• Use it only for non-sensitive tasks
• Never install new apps
• Don’t access financial services
• Consider factory reset and repurpose (media player, security camera)

Buying Smart

Good News: You don’t need to spend $1,000+ to be secure.

A 2025-2026 mid-range phone running Android 15 or 16 is infinitely more secure than a 5-year-old flagship stuck on Android 12.

What to look for:

• Android 15 or 16 out of the box
• Manufacturers promising 7 years of updates (now standard for Google Pixel 9 series and Samsung Galaxy S25 series)
• Regular monthly security patches
• Confirmed update track record from the manufacturer

Why Android Faces This Problem

Unlike Apple, which controls both hardware and software for iPhones, Android depends on individual manufacturers to deliver updates. Companies like Samsung, Xiaomi, Oppo, and Motorola manage their own timelines and often abandon devices after just a few years.

According to industry analysis:

• Apple’s iOS 26 runs on approximately 50% of iPhones
• Android’s fragmentation means 42% of devices lack security updates
• Manufacturers prioritize new phone sales over supporting older models

The Real-World Risks

Using an unsupported Android device exposes you to:

Financial Theft

• Stolen banking credentials
• Intercepted SMS 2FA codes
• Unauthorized transactions
• Cryptocurrency wallet theft

Data Breaches

• Harvested contact lists
• Stolen messages and emails
• Location tracking
• Photo and file exfiltration

Device Compromise

• Remote control by attackers
• Ransomware infections
• Inclusion in botnets for DDoS attacks
• Persistent surveillance

As cybersecurity researcher Shahak Shalev from Malwarebytes warns: “When spyware jumps 147% in five months, that tells us attackers are moving beyond simple scams to building sustainable criminal enterprises.”

Take Action Today

The question is no longer “if” you’ll be targeted, but “when.” Automated bots scan the internet 24/7 specifically looking for vulnerable devices.

Your Security Checklist

1. ✅ Check your Android version (Settings > About Phone)
2. ✅ Back up all important data immediately
3. ✅ If running Android 12 or older, plan to upgrade within 30 days
4. ✅ Enable automatic updates on your new device
5. ✅ Choose manufacturers with 7-year update commitments
6. ✅ Never download apps from outside Google Play Store
7. ✅ Review app permissions regularly

The Bottom Line

Over 1 billion Android users are running phones that no longer receive critical security protection. With sophisticated malware campaigns actively targeting these devices, continuing to use an unsupported phone—especially for banking or sensitive data—is a calculated risk.

Your digital security, financial information, and personal privacy are worth more than holding onto an old device. The cost of a mid-range phone is far less than the potential cost of identity theft, financial fraud, or data breach.

Check your version today. Update your software. Upgrade your device if necessary.

Sources & Additional Reading

• Google Android Distribution Statistics (December 2025)
• Forbes: “Google Warns Over 1 Billion Android Phones Are Now at Risk”
• Malwarebytes: “Android Threats in 2025” Report
• Kaspersky: Q2 2025 Mobile Threat Landscape
• Android Authority: “Android 12 End of Life Confirmation”
• TechRepublic, Gulf News, India TV: February 2026 security coverage

About This Article: This analysis is based on verified data from Google, cybersecurity firms, and industry publications. All statistics and threat descriptions are sourced from official security bulletins and peer-reviewed threat intelligence reports from February 2026.