Based on Mishaal's post on Twitter (https://twitter.com/mishaalrahman/status/1705934521751806033), the patch will be in SPL released marked with 2023-10-06 date.

Pixel 5 should still qualifiy for it.

My phone came out in 2017. I'm still on Android 8. There's an update to Android 9.1 available somewhere, but AT&T never got around to porting it to their crapware-riddled fork.

Galaxy S8?

LG V35.

A phone released in October 2020 is about to stop getting security updates?!

Pixel used to be 3y of security updates. Starting with the 6 (2021) they switched to 5y. https://endoflife.date/pixel

Supposedly 7 years soon. Maybe. https://www.theverge.com/2023/9/25/23888831/pixel-8-pro-seve...

It appears so: https://support.google.com/pixelphone/answer/4457705?hl=en#z...

Can this be fixed with a rooted Pixel with Lineage OS?

Looks like this is it [1] and it looks like LineageOS 17 is supported even back to Pixel 3a [2].

[1]: https://review.lineageos.org/c/LineageOS/android/+/366611

[2] https://forum.xda-developers.com/t/lineageos-17-for-pixel-3a...

> A phone released in October 2020 is about to stop getting security updates?!

I actually looked into it, my previous phone was released in June 2020.

The last security update for the phone came out in January 2022.

I'm not sure whether they're just updating things infrequently or whether that model is abandoned altogether, but neither would speak highly of the Android support landscape for non-flagship phones.

This ends up being kind of silly: if I want to have a mostly secure backup device (for 2FA and my bank/eID apps), then I probably need two comparatively recent devices, since a 5 year old budget phone would no longer quite do as a temporary daily driver, in case I'd lose my main phone.

Which phone would that be?

It's this manufacturer https://www.ulefone.com/index.html and probably many more out there, typically in the budget segment.

I can say that their rugged designs served me well, but some of the newer phones apparently have this weird component for wireless earphones and I don't really want that, so my current and future purchases are from different manufacturers. Was actually pretty close to stock Android, though!

Oh yeah, those OEMs are outright terrible with their support cycles :(

It stops getting guaranteed security updates, whatever that means. If this is really so serious that it enables drive-by attacks on the web, it'd be negligent not to port the fix to older OSes.

Google cut off my Chromebook about 8 months back but still pushes what I'm assuming are security updates (although they've slowed as of late).

I just checked, and in the last 30 minutes a update has become available for my Pixel 5.

The security bulletin doesn't reference this CVE specifically but does mention a critical vulnerability that could lead to RCE.

The problem is that they'll use the opportunity to schlep a bunch of non-security related stuff into the update as well. That's the thing that really bothers me about these, that you can't say just the security patches and hold the telemetry/marketing/spyware/adware/crapware/malware/etc.

Updates outside the quarterly feature drops on Pixels are pretty much exclusively security patches so I have no idea what you're talking about.

This is what I'm talking about:

https://support.google.com/product-documentation/answer/1141...

Good luck setting things up in such a way that you only get security patches and not a whole bunch of 'improvements' to go with them.