Exploits, Tools & Data Recovery · How Bugs Become Attacks · Lesson 4 of 5

Zero-Days & the Patch Gap

Tell zero-days from n-days, and see why some Android phones wait months for fixes.

Zero-days and n-days

"Zero-day" shows up in a lot of headlines. A zero-day is a vulnerability that attackers exploit before the vendor has a fix available. The name means defenders have had zero days to patch. Google's Threat Intelligence Group defines it as a flaw "maliciously exploited in the wild before a patch was made publicly available."

An n-day is a flaw that has already been fixed and published, where n is the number of days since. The patch exists, but any device that hasn't installed it is still exposed. N-days are cheaper for attackers to use, because the fix itself points to the flaw, and plenty of devices stay unpatched.

How often are zero-days caught in use? Google has tracked this for years, first through Project Zero, its team that hunts flaws in many companies' software, and more recently through its Threat Intelligence Group. Project Zero also keeps a public "0day In the Wild" spreadsheet listing each case. Some figures from Google's yearly reviews:

• The review of 2022 counted 41 zero-days detected in the wild that year, down from 69 in 2021. Over 40 percent were variants of previously reported flaws, meaning an earlier fix had closed one bug but missed close cousins.
• The review of 2025, published in March 2026, counted 90 zero-days exploited in 2025, compared with 78 in 2024 and 100 in 2023. Mobile operating systems accounted for 15 of the 2025 total. For the first time, more were attributed to commercial surveillance vendors than to traditional government spying groups.

Treat these as estimates. Google says its counts include only what it could detect, and that numbers may change as past attacks come to light. Its earlier report, for example, gave 75 for 2024.

What does this mean for you? A zero-day is usually expensive and used carefully against a few targets, since each use risks getting it discovered and fixed. Once it's caught and patched, it becomes an n-day. From that moment, your protection depends on one thing: whether you've installed the update.

The Android patch gap

On iPhone, Apple writes the software and ships each update to every supported model at once. Android works differently. Google publishes fixes in its monthly bulletin, but most Android phones are made by other companies, such as Samsung, Motorola or Xiaomi. Each maker has to take Google's fixes, plus fixes from chip suppliers, fit them into its own version of Android, test them and send them out, sometimes through mobile carriers too.

The delay between a fix being available and it reaching a particular phone is called the patch gap. On Google's own Pixel phones it's usually short. On other models it can be weeks or months, and it varies by brand, model and country.

Google's review of 2022 put it bluntly: "N-days function like 0-days on Android due to long patching times." BleepingComputer's coverage of that report described a flaw in Arm's Mali graphics driver, used in many Android phones. Arm released a fix in October 2022, attackers were seen exploiting the bug in November 2022, and the fix reached Android's security update in April 2023. For about six months, a patch existed that many phones couldn't get.

The gap becomes a wall when a phone reaches end of support. After that, the maker stops shipping security updates entirely. Every flaw fixed later, in bulletins the phone will never receive, stays open on it for good, and attackers know older phones are easy targets.

Support periods have grown. Google promises 7 years of OS and security updates for the Pixel 8 and later, and Samsung offers similar terms on recent flagship models. In the EU, rules that took effect in June 2025 require new phone models to keep getting updates for years after they stop being sold. Budget and older models often get far less.

So when you choose a phone, the update promise is a security feature. Before buying, look up how long the maker supports that model, and check its current patch level.