The 5 May 2017 security patch fixes more than 100 vulnerabilities – Google is serious about Android security. The catch 22 is whether you will get these updates over the air (OTA) from your telco in a timely manner.
Of the 100 vulnerabilities, 29 were critical relating to hardware specific drivers, components, and the kernel. Mediaserver has special attention where multimedia messages (MMS) can be used to launch an attack – that is why Google disabled the automated display of messages in the Android text messaging app.
Another patch closes the loophole that law enforcement has been using to bypass the lock screen. But the hardware drivers are another story – they represent a backdoor that Google does not even know about until it has been exploited.
These come from things like a NVIDIA video driver, a Qualcomm and Motorola bootloader, and a MediaTek touch screen driver ...
{loadposition ray}
While Google directly updates Nexus and Pixel devices it is now up to the OEMs to test and roll out updates via telcos.
On the whole flagship, makers do a reasonable job getting updates out in a month or so but the majority of low-cost handsets never see them. More and more it is becoming an imperative to buy from a brand that pays attention to security and Google says all users are encouraged to update to the latest version of Android where possible.
To be fair Apple’s iOS is what is called a walled garden and apart from jailbroken phones, most users get OTA updates from Apple. Similarly, Microsoft has taken responsibility for OTA for all Windows devices. Google moves closer to that with every new version of Android.
The Android security bulletin is here. Google has broken the patches down into two – security and hardware – in the hope the former will be rolled out faster.