  In this paper, we perform a comprehensive study of 2,470 patched Android
vulnerabilities that we collect from different data sources such as Android
security bulletins, CVEDetails, Qualcomm Code Aurora, AOSP Git repository, and
Linux Patchwork. In our data analysis, we focus on determining the affected
layers, OS versions, severity levels, and common weakness enumerations (CWE)
associated with the patched vulnerabilities. Further, we assess the timeline of
each vulnerability, including discovery and patch dates. We find that (i) even
though the number of patched vulnerabilities changes considerably from month to
month, the relative number of patched vulnerabilities for each severity level
remains stable over time, (ii) there is a significant delay in patching
vulnerabilities that originate from the Linux community or concern Qualcomm
components, even though Linux and Qualcomm provide and release their own
patches earlier, (iii) different AOSP versions receive security updates for
different periods of time, (iv) for 94% of patched Android vulnerabilities, the
date of disclosure in public datasets is not before the patch release date, (v)
there exist some inconsistencies among public vulnerability data sources, e.g.,
some CVE IDs are listed in Android Security bulletins with detailed
information, but in CVEDetails they are listed as unknown, (vi) many patched
vulnerabilities for newer Android versions likely also affect older versions
that do not receive security patches due to end-of-life.
