1
Google has restructured Android’s decade-old monthly security update process into a “Risk-Based Update System” that separates high-priority patches from routine fixes. Monthly bulletins now contain only vulnerabilities under active exploitation or in known exploit chains — explaining July 2025’s unprecedented zero-CVE bulletin — while most patches accumulate for quarterly releases.
The September 2025 bulletin contained 119 vulnerabilities compared to zero in July and six…
