&gt; Android security lags behind, because Google doesn&#x27;t want to force OEMs and providers to provide updates.<p>What do OEM updates have to do with a security hole in <i>Chrome</i>? Despite all the merger chatter, Chrome isn&#x27;t an OS-level part Android the way it is with ChromeOS.<p>The exploit sounds serious, but once the Chrome team understands it and comes up with a fix, all Google needs to do to deploy it is publish a new version of Chrome on the Play Store. I suppose they could add a nudge or two via Play Services (or otherwise) if people aren&#x27;t installing the new version, but, in any case, that&#x27;s nowhere near the effort required to get an OS update out (and neither OEMs nor carriers can block the fix).