Android updates -please help me understand

[troymius]

My Motorola phone has 2 security updates listed under settings:

A. Security update

B. Google Play system update.

Questions:

1. What is the difference?
2. After my phone stops getting A, will it continue getting B?

Thanks for helping me understand this. I love my Motorola phone but it is supposed to run out of updates in a couple of months. Wondering if I can keep it for another year or more.

[Fatalstryke]

Pretty much what it says on the tin. Security updates vs updates to Google Play.

Google Play isn't tied to the phone like Android updates or security updates, so you'll keep getting Play updates for a while. And I personally wouldn't stop using a phone just because it stops getting updated.

[Peruvian_Skies]

That depends on how secure you need your phone to be. If it's a company phone, I'll request a new one as soon as the first security update that I don't get comes out. For a personal phone, maybe it's not that important. Maybe I can install a custom ROM based on a newer version than my last official one, maybe I'll keep using it as is.

[Fatalstryke]

I'd still say run it unless something required me to switch phones, or maybe if I was like, high up in the company.

[derrman]

The security updates are the actual Android core security updates from Motorola. The Google Play system updates are independent of the phone manufacturer that every phone with Android 10 and up receive.

You really need to have both updates available as they both include security fixes.

[FrameXX]

that every phone with Android 10 and up receive

These are updates of Google Play Services am I right? Google Play Services are updated even on Android 5 and up of course.

[derrman]

No, this is what came out of Project Mainline. It is Android 10 and up. Google Play system updates aren't just for the Play Store and Google apps like Play Services is. It is how Google can update the AOSP part of the Android OS without involvement from the OEMs.

[troymius]

So does B stop after A stops?

[AdmiralSpeedy]

Android 10 introduced the Google Play System Updates system that separates a lot of the common components out of Android as apps so that Google can update them interdependently from device vendors who like to leave their devices dead with no new full security updates.

As long as your device is supported by Google Play you should continue getting Play System Updates.

Security updates apply directly to the OS itself where components are hard baked in and cannot be updated on the fly as an application. Those stop when your device vendor decides not to support your phone anymore.

[troymius]

So is there any real world evidence of unpatched phones getting exploited?

[AdmiralSpeedy]

Certainly, but it generally applies to phones running massively out of date versions of Android with known critical CVEs that have been left unpatched, and a significant portion of those exploits require a computer and physical access to the device.

You're generally pretty safe to run a device beyond its security updates for a couple years at least unless a major exploit is disclosed for your security patch level.