Quantifying risk of not upgrading Android (ie Android 8.1 to newer version)

Question

I am running an Android One (ie vanilla Android supported by Google) phone which has Android 8.1. I have unlocked the bootloader and rooted my device.

Because I've rooted my device I have not been able to apply "System Updates" to my phone for close to a year. Revisiting the available versions I see new versions are Android 9, and will require a full reinstall.

I realised I really like my system as is and dont want to make any changes and indeed I'm concerned of the possibility of some cool functionality may be disabled (like ability to change MAC address, ability to stop charging phone at a preset level).

From a security POV, what are the real risks of running on an outdated version of Android 8.1, assuming I am judicious about the Apps I install and don't go clicking on adverts/spam?

Answer 1

From a security POV, you're exposing yourself to every security vulnerability that has been patched since you last applied updates. There's far too huge a number to really be aware of every single security flaw, but you can get a decent idea by looking at the List of Android Security Vulnerabilities and using the buttons at the top to include only higher scoring vulnerabilities (such or 8 or 9). Most of the 9s don't require installing anything. Some of them don't even require user interaction, for example CVE-2018-9476 which exploits the Bluetooth driver without requiring any user action.

The bottom line is that updates exist for a reason, and when you're talking about updates to the operating system itself, you can't assume that there's any action you can take that will negate every possible vulnerability other than installing updates. If you do choose to accept the risk of operating without updates, I would absolutely recommend keeping up to date on Android Security Bulletins and looking for new vulnerabilities which would apply to your device and OS which are marked critical to determine if you're willing to accept the risk posed or if you feel you need to update after being aware of what your system is vulnerable to.