Your Android Patch Date Tells Half the Story. Google Should Show You the Rest

Open Settings on almost any Android phone, dig into About phone, and you’ll find one date that’s supposed to sum up how safe your device is: the Android security patch level. For years, that single date has been the shorthand reviewers, IT departments and careful owners have used to judge whether a phone is up to date.

Google just admitted, in so many words, that the shorthand isn’t good enough. I agree. But the fix it shipped only helps apps, and that’s where I think it stops short.

What Google changed

On September 18, Google released stable versions of two developer libraries: AndroidX Security State 1.1.0 and Security State Provider 1.0.0. Together they let an app look past the single patch date and check the security status of individual parts of the system.

The libraries track three different numbers, according to the Android Developers Blog:

• Device SPL: the patches actually installed on the phone
• Published SPL: the newest patches listed in Google’s Android Security Bulletins
• Available SPL: patches that are already downloaded and staged, waiting for you to install them

And they break the phone into components: the system image that your manufacturer updates over the air, the system modules that Google updates through Google Play system updates (Project Mainline), and the kernel, which is measured by its long-term-support release rather than a monthly date. Apps can even check whether a specific CVE has been fixed, such as a flaw in Bluetooth or NFC.

Google’s own examples are sensible. A banking app could see that a fix is staged and ask you to install it before approving a big transfer, instead of flatly refusing to work. A company app could nudge you to update rather than lock you out.

Why one date was never enough

Android hasn’t been updated as one monolithic blob for years. Your manufacturer pushes some fixes. Google pushes others through the Play Store without any full system update at all. As Android Authority put it, “your phone might still show an older overall security patch date even though a particular security vulnerability has already been fixed.”

That cuts both ways. A phone that looks stale might be better protected than its date suggests. And a phone with a fresh-looking date tells you nothing about its kernel, which follows a completely different release track. The single number flattens all of that into something that’s easy to read and easy to misread.

The problem: this is for apps, not for you

Here’s my complaint. All of this richer information is now available to developers through a library, and none of it is on the screen where owners actually look. If a bank’s app can know that my phone has a critical fix staged and waiting, why can’t I see that in Settings next to the patch date?

Google already has the pieces. Android 17 supports OEMs disclosing individual fixes, per Android Authority, and Google Play system updates already report through the new provider. Turning that into a simple “Security status” page, with a line for system, Google Play modules and kernel, and a clear “an update is waiting” prompt, is a product decision, not a research project.

It would also put some healthy pressure on phone makers. The Developers Blog says Google Play system updates and Google’s own OTA client already comply with the new provider, and that “additional OEM OTA clients are being onboarded.” That’s polite language for: not everyone is on board yet. A visible status page would make it obvious which brands share their data and which don’t.

What Google should do next

I’d ask for three things, in this order:

1. Show the component view in Settings on Pixels first, as a model for everyone else.
2. Make the provider a requirement for phones that ship with Google apps, with a deadline.
3. Keep the old patch date, but label it honestly as the system image date, not the whole story.

The AndroidX libraries are a real step forward for security on Android, and developers should adopt them. But security information that only apps can read is still information kept from the people who own the phones. Google has done the hard part. It should finish the job.

Sources: Android Developers Blog, Android Authority, Help Net Security. Photo by Franck on Unsplash.