The Dutch consumer association Consumentenbond applied the lastest manufacturer’s updates on 171 Android smartphones that it had acquired over the last two years. It found only one in six of the updated phones were running Android 5.0, released last November, or a newer version. Half of the phones, even after updating, still ran a version two years old (Android 4.3), or older, which have known security flaws.

The Dutch consumer association Consumentenbond, which  carried out the tests, said "We believe that consumers are entitled to a reliable and safe device,” but the issue should concern developers, providers of e-commerce services and enterprise IT teams delivering services to a mobile workforce.

Top end Android smartphones get security updates first but a long tail of vulnerable devices remains. Image: IDG News Service

Manufacturers differ in how they keep the Android software in their phones up to date.

More than half the Huawei Technologies phones tested were running Android 4.3 or lower, while the rest ran 4.4. This compares to five of eight Motorola Mobility smartphones tested by the association, which  ran Android 5.0 or 5.1.

The association didn't say how the final software version related to the age of the phones. However, even within a single manufacturer's product range, there can be little correlation: Consumentenbond's two-year-old HTC One updated to Android 5.0, but HTC has said the much younger HTC One Mini 2, released in May 2014, will not receive the update.

Samsung Electronics, the biggest Android phone manufacturer, also has many phones for which up-to-date software is unavailable, Consumentenbond said.

Support for competing operating systems including iOS and Windows Phone is much better, the organization said. It said iOS devices are supported for about four years while Microsoft has promised to upgrade all Lumia phones running Windows Phone 8 (released in October 2012) to Windows 10.

A recent report by Computerworld in the US slammed phone manufacturers for providing poor information about the updates they do provide, and taking a long time to deliver them.

As of June 1, around 12.4 percent of devices accessing the Google Play Store were running Android Lollipop (versions 5.0 or 5.1), some six months after its release, with the highest proportion, 39.2 percent, running Android 4.4 (KitKat), released in October 2014.

In tests performed by Computerworld in May, major manufacturers took up to 147 days to get the Lollipop upgrade to their then-current flagship phone. Google shipped the Nexus 6, manufactured for it by Motorola Mobility, with Android 5.0 already loaded, and Motorola's own flagship, the 2014 Moto X got the update in nine days. Sony was the slowest with its Xperia Z3 and Xperia Z3 Compact.

Google was also the quickest to upgrade its previous flag ship phone: The Nexus 5, manufactured for it by LG Electronics, had the upgrade after 14 days, but by May the previous Moto X version was still waiting. Motorola finally rolled out the 5.1 Android Lollipop upgrade for the 2013 Moto X on June 20.

Market leader Samsung took 91 days to update the Galaxy S5 and 122 days for the Galaxy Note 4. Computerworld said Samsung was the worst when it came to communicating about updates, keeping customers in the dark about which devices it plans to update. It used to provide detailed info, but has stopped doing so after it repeatedly failed to keep its promises, which caused a fair amount of negative publicity.

With the hardware changes between successive generations of smartphones increasingly small, manufacturers are perhaps reluctant to discourage upgrading by providing new software features on older devices for free -- but by not fixing security bugs they could pose a wider threat to the digital economy.

Find your next job with techworld jobs