Android vs iPhone: Which Is More Secure? CVEs, Zero-Days, Exploit Prices and Patch Speed in Numbers (2026)

For a working zero-click exploit on the iPhone, brokers today pay up to $7 million. For the same thing on Android – up to $5 million. Case closed, the iPhone is more secure? Not so fast. In 2019 it was exactly the other way round: Zerodium paid $2.5M for Android and $2M for iOS, and its CEO explained that the market was simply flooded with iPhone exploits. 💥

“Michał, which is more secure: iPhone or Android?” – I get this question regularly. From friends, from clients, from CEOs who are just replacing their company phone fleet. And I always give the same answer: it depends on what you measure. Because in this debate everyone has an opinion, but hardly anyone has numbers.

So I did what I enjoy most: I gathered hard data in one place. The number of vulnerabilities (CVEs), zero-days used in real attacks, patching speed, exploit prices on the black market, hacking competition results, malware and phishing stats, bug bounty programs. Plus a short look at how both systems’ defences work and how real attacks got around them – including why a feature built for people with disabilities is today Android thieves’ favourite tool. Every number has a source and a date (list at the end). And finally – the verdict and 7 things everyone should do, whatever logo is on the back of their phone.

Table of contents

1. Before we compare: one apple vs a whole bag of apples
2. How many CVEs does Android have, and how many does iOS?
3. Zero-days in real attacks: 15 against mobile devices in 2025
4. How fast are vulnerabilities patched? Apple vs Google
5. What a break-in costs – the black market price list and Pwn2Own
6. How big is the security team? Bug bounty and app store defences
7. Malware and phishing: where the money is really lost
8. Pegasus, Graphite and co.: who is the target
9. Walls and back doors: how attacks bypass defences (and why accessibility features are dangerous)
10. The verdict: scorecard
11. 7 things to do regardless of your system
12. FAQ

Before we compare: one apple vs a whole bag of apples

One honest remark up front, because without it the whole comparison is unfair. The iPhone is one manufacturer, one system and one store. “Android” is Google’s Pixel, Samsung with its own skin and its own security bulletin, Xiaomi, Motorola – and at the very end a cheap supermarket phone for about 100 euros that got its last update on launch day. So we are comparing one apple with a whole bag of apples of varying freshness.

The scale isn’t symmetrical either. Worldwide, Android has 69% of the market and iOS 31% (StatCounter, September 2026). In Poland the split is closer: 64% Android, 36% iOS. A bigger share is a bigger magnet for mass crime – a criminal writes a banking trojan where they have the most potential victims.

And then there’s support, because it decides whether a patch ever reaches you at all:

• Pixel 8 and newer: 7 years of OS and security updates (Pixel 6/7: 5 years).
• Samsung Galaxy S24/S25: 7 years.
• Cheaper Androids: it depends on the manufacturer and model, usually noticeably shorter than flagships. Before you buy, check the promised update period on the manufacturer’s website.
• iPhone: Apple doesn’t promise any number of years. But iOS 27, released on 14 September 2026, still runs on the iPhone 11 from 2019 – so in practice about 7 years.

Lesson #1: The question “Android or iPhone” is the wrong question. The right one is: “which Android?”. A Pixel with 7 years of support and a no-name phone with two years are two different worlds, even though both are called Android.

How many CVEs does Android have, and how many does iOS?

For the non-technical: CVE is a public catalogue of vulnerabilities – every disclosed hole gets a number so that everyone is talking about the same bug. I wrote more about it in my post on cyber threats 2026 in numbers.

Zimperium counted in its Global Mobile Threat Report 2025: in 2024 Android got 501 CVEs, iOS – 317. The number of zero-days – holes exploited in attacks before a patch existed – looks even more interesting: Android 41 / 97 / 12 in 2022 / 2023 / 2024, iOS 5 / 20 / 5 respectively.

First reflex: “Android has more holes”. Second reflex, the pentester one: the CVE count tells you more about who counts how, and how many people are looking, than about how secure a system is. Why?

• Android’s CVEs include third-party components: modems, Qualcomm and MediaTek chips. In its bulletins Google patches other companies’ bugs. Apple designs its own chips and counts differently.
• Android is open source – anyone can look at the code and report a bug. In closed iOS, hunting for holes is harder, so some of them simply never get a number.
• Since 2025 Google has changed the rhythm of its bulletins (more on that in a moment), so even a year-on-year comparison within Android alone is getting tricky. For scale: in the first half of 2025 the Android Security Bulletin patched about 270 vulnerabilities, the December 2025 bulletin alone – 107. Apple patched 27 CVEs in iOS 26.0 (according to SecurityWeek; Apple’s own list has more entries, because a single hole can affect several components).

Much more interesting than the raw count is the quality of the bugs. For years Google has published the share of memory safety bugs (the class of holes most exploits are built from) among Android vulnerabilities: 76% in 2019, 24% in 2024 and below 20% in 2025. That’s thanks to Rust – Android already has about 5 million lines of code in that language, and Google reports roughly 1,000 times fewer memory bugs per million lines than in C/C++. Apple responded in September 2025 with Memory Integrity Enforcement (MIE) in the iPhone 17: always-on hardware memory tagging that Apple calls “the most significant upgrade to memory safety in the history of consumer operating systems”. Google had hardware MTE in the Pixel 8 back in 2023, but as an option; Apple switched it on for everyone, by default. ✔️

Lesson #2: Don’t buy a phone based on its CVE count. Buy based on whether the manufacturer invests in eliminating entire classes of bugs – and here both giants have done more in the last two years than in the whole previous decade.

Zero-days in real attacks: 15 against mobile devices in 2025

The toughest metric isn’t “how many holes were found” but “how many holes were used against people before a patch existed”. Google Threat Intelligence Group counts this every year:

• 2025: 90 zero-days exploited in attacks (2024: 78, 2023: 100). Of these, 15 on mobile platforms (2024: 9, 2023: 17).
• Broken down by company (all products, not just phones): Microsoft 25, Google 11, Apple 8.
• Chains of several zero-days at once almost exclusively (about 90%) target phones. In 2025 chains of three or more bugs were more common than a year earlier – because a single hole is no longer enough to break through the defences.
• The only per-platform breakdown Google gave: in 2024 7 zero-days affected Android, 3 of them in third-party components. Google didn’t publish such a figure for iOS.
• For the first time in the history of the measurement, more zero-days were attributed to commercial spyware vendors than to state espionage groups.
• A fresh iOS example: on 28 September 2026 Apple released iOS 26.7.1 with a patch for a hole in CoreGraphics (CVE-2026-86950) which, according to Apple, may have been exploited in an “extremely sophisticated attack” against specific individuals on versions older than iOS 27. In contrast: the October Android bulletin (25 CVEs) doesn’t flag any hole as exploited. One month proves nothing – but it shows nicely that “the iPhone has no zero-days” is a myth.

The recommendation from the same report fits in one sentence, so I’ll repeat it: turn on Advanced Protection on Android (from Android 16) or Lockdown Mode on the iPhone. These are modes “for high-risk people”, but for a CEO, a lawyer or a journalist they are simply a sensible setting today.

Lesson #3: In the world of zero-days both systems are targets, and the differences are smaller than the internet suggests. What matters is not so much the bugs as how much it costs to build a working attack out of them – more on that in a moment.

How fast are vulnerabilities patched? Apple vs Google

The best independent measurement comes from Google Project Zero – a team that reports bugs to all vendors (Google included) and publicly counts how many days it takes them to ship a patch. The deadline is 90 days.

For 2019-2021: iOS averaged 70 days, Pixel 72, Samsung 72. In other words, a draw. In the 2025 table (as of March 2026) Apple has not a single report, so no comparison is possible; the Pixel 10 needed 73, 98 and 98 days (twice past the deadline), and Samsung patched image codecs in 49 days on average. A curiosity from the same overview: browsers. Chrome needed 30 days from report to shipping the fix to users, WebKit (Safari’s engine) – 73. Apple patches fast, but ships on its own schedule.

The thing is, “patch released by the vendor” is not the same as “patch on your phone”. And this is where the real difference begins:

Android changed its rhythm. For ten years Google published a monthly bulletin with patches. In July 2025 came the first empty bulletin in history, and since September 2025 a “risk-based” system has been in place: each month only actively exploited holes or those that are part of known chains, with the rest in large quarterly releases. Partners get the code several months earlier, and since 2026 the AOSP source code is published twice a year. For Samsung or Pixel users this is neutral in practice. For makers of alternative systems (e.g. GrapheneOS) it’s a problem – patches reach them later.

Apple went the other way. In March 2026 it released its first Background Security Improvements: small patches (here: for a WebKit hole, CVE-2026-20643) installed in the background, without a full system update and without a restart. The window between release and deployment shrinks to a minimum.

And here is the end result – how many phones actually run the latest system. Mind the dates: these are the latest measurements the vendors have published. Since then iOS 27 (September 2026) and Android 17 have come out, but neither Apple nor Google has released new figures.

• iOS 26: 79% of all iPhones and 86% of models from the last 4 years (Apple, June 2026, 9 months after launch).
• Android 16: 7.5% of devices in Google’s sample from December 2025 (6 months after launch); in web traffic measured by StatCounter in September 2026 – 38%. Different methods, but neither comes close to Apple.
• Zimperium: over a year, 61% of Android devices and 49% of iOS devices were at some point on an outdated OS version, and about 25% of corporate devices can’t be updated to the latest version at all.

Lesson #4: At the source, Apple and Google patch at a similar pace. The difference is in the road to your pocket: an Apple patch lands on 4 out of 5 iPhones, a Google patch has to pass through the manufacturer, the carrier and the skin version. That’s why, if your company uses Androids, a “we update within 14 days” policy has to be enforced via MDM (software for managing company phones), not left to the users.

What a break-in costs – the black market price list and Pwn2Own

The most honest security indicator is price. Not my opinion, not marketing – just how much someone is willing to pay for a working attack. Exploit brokers (companies that buy zero-days for governments) publish price lists:

• Zerodium, 2019: Android zero-click $2.5M, iOS $2M. For the first time in history Android was more expensive. The CEO’s reasoning: the market was flooded with iOS exploits, mainly for Safari and iMessage, while Google had “quietly” hardened Android so much that a full zero-click chain had become harder to build.
• Operation Zero (Russia), current price list: Android $2.5M, iOS $2M. In September 2023 the company advertised occasional offers of up to $20M for full chains on both systems. In 2025 an American, a former division head at L3Harris Trenchant, pleaded guilty to selling them exploits – he got about 7 years.
• Crowdfense (UAE), 2024: iOS zero-click $5-7M, Android up to $5M, Chrome up to $3M, Safari up to $3.5M. The price list hasn’t changed since. The company’s comment: “the security measures vendors are rolling out are working” – an exploit that one person used to write now takes a team.

So in 2019 Android was more expensive, in 2024 iOS is. The takeaway? Both systems are such hard targets today that a working chain costs as much as ten houses in Warsaw. Nobody will spend that kind of money to steal your holiday photos – this is money for political and intelligence goals.

The second impartial measurement is Pwn2Own – a competition where the world’s best teams break devices live for prize money from the organiser (Zero Day Initiative):

• Ireland 2024: Galaxy S24 broken (a chain of 5 bugs, $50K prize). The Pixel 8 and iPhone 15 each carried $250K. Nobody even registered an attempt.
• Ireland 2025: Galaxy S25 broken twice ($50K each). For the Pixel 9 and iPhone 16 the offer was $300K each – zero entries.
• Ireland 2026: here’s the breakthrough. The Pixel 10 fell three times on the final day, and for one of those chains Ikotas Labs took home $300K – the biggest prize of the whole competition. The Galaxy S26 was broken 7 times, mostly with “collisions” (bugs the vendor already knew about, so smaller prizes). For the iPhone 17 (also $300K) nobody signed up for the third year in a row. The whole competition: 98 zero-days and $1.26M paid out.

Why has nobody tried the iPhone for $300K in three years? Because a working chain is worth about 20 times more to brokers – showing it at a competition is bad business. That makes this year’s Pixel all the more interesting: three teams decided it was worth showing off. What exactly failed isn’t known yet – ZDI only discloses bug details after 90 days, once the vendor has patched them. Samsung, with its own skin and its own apps, simply has more code to search through – and that’s why it falls every year. 😈

Lesson #5: The iPhone and the Pixel are still “hard targets” – targets that, in a real attack, mainly nation states can afford. But this year’s Pixel is a reminder that a hard target is not an untouchable one: attack difficulty isn’t a constant, it’s a race the vendor has to win anew every year. The rest of the Androids rank lower, in proportion to the amount of the manufacturer’s own code and how fast it patches. If you’re choosing a fleet for exposed people (management, finance, lawyers) – this criterion should weigh more than the price of the phone plan.

How big is the security team? Bug bounty and app store defences

I wanted to put two numbers here: how many security engineers Apple has, and how many Google has. I can’t – neither company publishes the size of its teams (Apple SEAR, Android Security, Project Zero). Any number you find online is a guess. But there are good proxy indicators: how much both companies pay outsiders to find holes, and how much junk they stop at the store gate.

Bug bounty: how much they pay for holes

• Apple: since November 2025 the top reward is $2M for a zero-click chain (previously $1M), and with bonuses (bypassing Lockdown Mode, bugs in beta versions) “over $5M”. Since the program launched in 2020, Apple has paid out more than $35M to over 800 researchers. In the Security Research Device program (special iPhones for researchers) the median payout in 2024 was about $18K, and a few times it reached $500K. In 2026 Apple is also giving away 1,000 iPhone 17s to civil society organisations at risk of spyware.
• Google: in 2025 all VRP programs paid out $17.1M to 747 researchers (more than $81M since 2010). Of that, Android and Google devices – $2.9M (a year earlier $3.3M; Chrome got $3.7M). Since May 2026 a full zero-click chain on a Pixel that breaks the Titan M2 chip and achieves persistence is worth $1-1.5M. Google openly explains: AI has flooded the program with long reports, so rewards go where bugs are hardest for AI to find.
• Samsung: up to $1M for remote code execution in Knox Vault; more than $4M paid out since 2017.
• On top of that, Google maintains Project Zero – a team that hunts for holes at Apple and Samsung too and publicly holds everyone to the 90 days. Apple has no public equivalent.

The store gate: how much junk never reaches your phone

• App Store, 2025: 9.1 million app submissions reviewed, more than 2 million rejected, 193K developer accounts terminated, $2.2B in fraudulent transactions blocked, 28K apps blocked on pirate stores.
• Google Play, 2025: 1.75 million policy-violating apps stopped before publication, 80K accounts banned, Play Protect scanning 350 billion apps a day and 27 million new malicious apps detected outside the store.

These numbers measure different things (Apple counts dollars, Google counts apps), but they show the scale: both giants run filtering factories at a level no Polish bank or e-commerce company even dreams of. 😈

Lesson #6: Team size isn’t public, but the money is. Apple pays more for a single exploit, Google more in total and more broadly. Both say the same thing: phone security today costs hundreds of millions of dollars a year. Your mobile app, written by a contractor in six months, doesn’t operate at that scale – and that’s why it’s in the app, not in the OS, that I most often find holes on engagements.

Malware and phishing: where the money is really lost

Zero-days and million-dollar exploits are the world of intelligence agencies. Ordinary people’s and companies’ money is lost elsewhere – through malicious apps and phishing. And here the picture is clear, just reversed in each category.

Malware: Android

• Kaspersky, 2025: 14 million blocked malware, adware and unwanted software attacks on phones (about 1.2 million a month), 815K new malicious installation packages and 255K new banking trojans – a several-fold increase year on year. Almost entirely Android.
• Lookout, Q3 2025: malware detections on corporate devices “overwhelmingly” involve Android; in a single quarter, 71K malicious apps on company phones.
• ESET, H2 2025: NFC attacks (the victim’s phone “hands over” their payment card to a criminal standing at an ATM) grew by 87%.
• Poland: in 2025-2026 CERT Polska described a series of campaigns targeting customers of Polish banks: NGate (impersonates SGB, Santander, PKO, ING, steals via NFC), FvncBot (SGB, Alior, Paribas; poses as a “Play component”), Cifrat (infrastructure posing as Booking). The common denominator: all of them are APK files installed manually on Android after the victim clicked through the “allow installation from unknown sources” screen.
• Google estimates that apps installed from outside the store carry more than 50 times more malware than those from Play. That’s why from 30 September 2026 (Brazil, Indonesia, Singapore, Thailand) and from 2027 globally, Android requires every developer to be verified – even outside the store. Zimperium: in companies, one in four Android phones has an app installed from outside the store.

For the record: iOS isn’t clean. In February 2025 Kaspersky described SparkCat – the first known malware in the App Store, which reads screenshots looking for crypto wallet recovery phrases. And since 2024 the iPhone in the EU also allows alternative app stores (six operating, according to TechCrunch), although every app still goes through Apple’s automated and human “notarisation”. So far I haven’t seen a high-profile incident from those stores.

Phishing: iPhone

• Lookout, Q3 2025: a phishing attempt was recorded on 16% of iOS devices and 7.8% of Android devices. In the whole of 2024: 26% vs 12%. Lookout fairly adds: in companies, iPhones go to executives and finance, so they’re simply a more valuable target.
• Zimperium, 2026: phishing on corporate phones has grown by 380% since January 2025, and spyware was detected on almost 1 in 10 devices (4 times more year on year).
• Google boasts of a study (YouGov, 5,000 people in the US, India and Brazil) according to which Android users were 58% more likely than iPhone users to receive not a single scam text in a week. Google commissioned the study, so I treat it as an ad – but AI filtering of texts and calls really is stronger on the Android side today. ⚠️

Lesson #7: Android loses on malware, the iPhone on phishing. The first can be handled with policy (“zero apps from outside the store” enforced via MDM); the second can’t be handled by the phone – because phishing attacks the human, not the system. On your CFO’s iPhone, a link to an “invoice” looks just as convincing as anywhere else.

Pegasus, Graphite and co.: who is the target

Commercial spyware is a league of its own: Pegasus (NSO), Predator (Intellexa), Graphite (Paragon). One fact worth remembering: each of them has a version for both systems. In 2025 Citizen Lab confirmed Graphite on the iPhones of two journalists (zero-click via iMessage, CVE-2025-43200, iOS 18.2.1) and at the same time on the Androids of two Italian activists (zero-click via WhatsApp). The same customer, both platforms.

• Apple sends spyware attack notifications in more than 150 countries; the August 2026 wave alone reached users in 110 countries. Apple doesn’t disclose the number of recipients.
• Lockdown Mode: in March 2026 Apple stated that it is not aware of any successful commercial spyware attack on an iPhone with Lockdown Mode enabled. This hasn’t been independently verified, but Google researchers have seen spyware that simply shuts itself down when it detects Lockdown Mode.
• Android: the equivalent Advanced Protection mode arrived in Android 16 (2025). An example from the other side: the LANDFALL spyware exploited a hole in Samsung’s image processing (CVE-2025-21042) for about 9 months before a patch arrived.
• Forensic tools: according to Cellebrite leaks from 2024, iPhones on iOS 17.4+ were “in research” (not unlockable), and according to an October 2025 leak, a Pixel 9 running GrapheneOS can’t be extracted at all – a regular Pixel can. So what can be pulled from a seized phone depends more on the OS version and configuration than on the logo.

Lesson #8: If someone spends millions to break into you specifically, the operating system won’t save you. Configuration will – Lockdown Mode / Advanced Protection, updates on release day, a restart once a day (most mobile spyware doesn’t survive a reboot) and the awareness that “don’t click links” is no longer enough, because zero-click doesn’t require a click.

Walls and back doors: how defences work and how attacks bypass them

On paper both systems defend themselves in similar ways. Every app sits in its own “room” (sandbox) and can’t see what the others are doing. Code must be signed. At boot, the phone checks that nobody has tampered with the system. Memory is protected by hardware mechanisms in the processor. The good news: practically nobody breaks through these walls head-on. The bad news: nobody has to. Attackers look for back doors – and each system has different ones.

iPhone: technical back doors worth millions

• BlastDoor vs a “GIF” that was really a PDF. In iOS 14 Apple locked iMessage processing inside a special sandbox called BlastDoor. In 2021 NSO (the makers of Pegasus) sent victims a file with a .gif extension that was actually a PDF inside. iMessage passed GIFs to a process running outside BlastDoor, and the image library recognised the real format and launched a decoder with a hole (CVE-2021-30860). Inside that decoder, the exploit built its own virtual computer out of more than 70,000 simple operations. Google Project Zero called it one of the most technically sophisticated exploits it had ever seen. And the subsequent sandbox escape relied purely on logic bugs, so hardware memory protections, as Project Zero admitted, had no effect on it at all. The wall was good. It’s just that not everything went through it. Apple patched this in iOS 14.8, and since iOS 15 GIFs are processed inside BlastDoor.
• Operation Triangulation: undocumented hardware. In 2023 Kaspersky discovered that its own employees’ iPhones had been infected through an invisible iMessage. The chain had 4 zero-days, bypassed pointer authentication (PAC – a mechanism meant to prevent hijacking a program’s control flow) and – most interestingly – hardware kernel memory protection. To do that, the attackers used processor registers that appear in no documentation and aren’t used even by Apple’s own software (CVE-2023-38606). Kaspersky called it the most sophisticated attack its experts had ever seen.
• When the wall held: BLASTPASS. In September 2023 Citizen Lab caught another NSO zero-click, this time via Apple Wallet attachments in iMessage. And here’s the good news: Citizen Lab and Apple both confirmed that Lockdown Mode blocked this attack. The mode disables, among other things, most attachments in Messages, JIT compilation in the browser (a favourite entry point for exploits), calls from unknown numbers, wired data transfer while the screen is locked, and the installation of configuration profiles and MDM.
• A back door without an exploit: the MDM profile. If you can’t afford a zero-day, you can simply ask. GoldPickaxe (Group-IB, February 2024) was first distributed via TestFlight (Apple’s official app testing platform), and when Apple removed it, the criminals talked victims in Vietnam and Thailand into installing an MDM profile – in other words, handing their phone over to be managed by a stranger’s “company”. The malware also asked for a video of the victim’s face, which was used to make deepfakes to fool banks’ biometric verification. Note: Lockdown Mode blocks exactly that – the installation of MDM profiles.

Android: accessibility features, a back door that costs pennies

Android has the same walls: sandbox, SELinux, verified boot, Play Protect with on-device AI analysing app behaviour (since 2024). But it also has something the iPhone doesn’t give third-party apps: accessibility services (the Accessibility Services API).

This API was created for a noble purpose – for blind and visually impaired people and people with motor disabilities. For a screen reader to read out to a blind person what’s on the screen, and for switch control to tap on behalf of a paralysed person, the app has to see everything on the screen and be able to tap for the user. In every app. Including the banking app.

For a banking trojan, that’s the keys to the kingdom. One “Allow” and the app can:

• read everything the phone displays – logins, balances, SMS codes – and record every keystroke,
• tap “Allow” on further dialogs by itself and grant itself more permissions,
• cover the real app with a fake login screen or a black screen with something going on underneath,
• and finally make a transfer itself in your real banking app, on your own phone. To the bank it looks like a normal operation from the customer’s trusted device. 😈

This isn’t theory. A few examples from recent years:

• Anatsa: about 150-200K infections via fake PDF readers and “cleaners” in the official Google Play (ThreatFabric, February 2024). They asked for accessibility access on the pretext of “putting battery-draining apps to sleep”. In 2025 another dropper posing as a PDF reader racked up more than 50K downloads in the US.
• Crocodilus (ThreatFabric, March 2025): takes over the phone and, so that the victim doesn’t see the device operating itself, shows a black screen and mutes the sound.
• Herodotus (ThreatFabric, October 2025): types text letter by letter with random pauses of 0.3 to 3 seconds, so that banks’ anti-fraud systems think a human is typing. Poland is among the targets on its list of fake screens.
• FvncBot – in my own backyard: it posed as the “mBank Security Key” (Intel 471, December 2025). CERT Polska (March 2026) described how, after installation, it registers an accessibility service innocently named “System Update”, with the right to read window contents and perform gestures. Then: keylogging, fake screens, screen streaming and remote control of the phone. For the record: not every Polish trojan works the same way – NGate, described above, steals via NFC and doesn’t need accessibility.

Google knows about this and has been playing cat and mouse with criminals for years:

• Android 13 (2022): an app installed from a downloaded APK file can’t request accessibility access – the option is greyed out.
• The criminals’ answer (2023): ThreatFabric described SecuriDropper – an intermediary app that installs the actual malware using the same method as an app store. The system can’t tell one from the other, so the block doesn’t work. FvncBot did exactly the same in 2025.
• Android 15 and 16: restrictions were extended to further sensitive permissions, and since December 2025 Google Play rejects apps that pretend to be tools for people with disabilities but aren’t. Play Protect also blocks them on phones.
• Android 17: enabling Advanced Protection automatically revokes accessibility access from all apps that aren’t genuine accessibility tools (screen readers, switch control, voice control, Braille). The catch: only if you turn that mode on. Password managers and automation apps, for example, lose it too.

The iPhone doesn’t have this problem for a simple reason: third-party apps don’t get an API that lets them read other apps and tap for the user. VoiceOver is part of the system. That’s one of the main reasons why mobile banking trojans are almost exclusively an Android thing.

A practical 30-second test: go to Settings → Accessibility and check the list of downloaded/installed apps with access enabled. If you see anything other than a tool you knowingly use (a screen reader, voice control), and especially a “system update”, a “PDF reader” or a “bank security key” – disconnect the phone from the internet and call your bank. A banking app doesn’t need this permission. ⚠️

Lesson #9: The walls are high in both systems today. You get into an iPhone through technical back doors worth millions – via exotic file formats and undocumented processor registers. Into an Android, a criminal more often walks through a human back door that costs pennies: one tap on “Allow” in accessibility settings gives them more than a million-dollar exploit. That’s why on Android, education and blocking installs from outside the store matter more than the phone model.

The verdict: scorecard

This is my subjective assessment – but every row is based on the numbers above. “Android” here means a Pixel or a Samsung with full support; a no-name supermarket phone loses to both in every row.

If I have to sum it up in one sentence: the iPhone is more secure “out of the box” for a person who configures nothing; a well-managed Pixel or Samsung under MDM is at least as secure for a company that does configure. And the worst choice is an Android without update support – whatever the price.

7 things to do regardless of your system

1. Automatic updates – on and verified. The only parameter in this post where the platforms differ tenfold. For company Androids: enforced via MDM with a deadline.
2. Zero apps from outside the store. 50 times more malware. If you don’t have MDM, turn off “unknown sources” and enable Auto Blocker (Samsung) or Play Protect. Every now and then, check which apps have accessibility access. On the iPhone – don’t install configuration or MDM profiles from links.
3. Lockdown Mode / Advanced Protection for management, finance, lawyers, HR. Yes, some things will stop working. That’s the price.
4. Restart once a day. Sounds silly, works against most mobile spyware, which has no persistence.
5. Buy based on support length, not the camera. 7 years (Pixel, Galaxy S) or an iPhone. A phone without updates is, after 2 years, a phone with a public exploit price list – for free.
6. Phishing-resistant procedures. The CEO’s iPhone will get the link just like the warehouse worker’s Android. A changed supplier bank account, an unusual transfer, something “urgent” from the boss – always a second channel and a second person.
7. Test your own mobile app. If your company ships an app for iOS or Android, it – not the operating system – is the weakest link. Apple and Google spend hundreds of millions a year on their part; your part costs a few days of testing. If you want to know exactly how much, use the calculator, and if you’d rather talk – get in touch.

FAQ

Is the iPhone more secure than Android?

“Out of the box” – yes: patches reach devices faster (79% of iPhones on iOS 26 versus 7.5-38% of Android devices on Android 16), there’s no mass malware and there’s one closed app store. But a well-managed Pixel or Samsung with 7 years of support and MDM is just as secure for a company, while cheaper Androids without support lose to both.

How many vulnerabilities (CVEs) does Android have compared to iOS?

According to Zimperium, in 2024 Android had 501 CVEs and iOS 317. The numbers aren’t fully comparable: Android’s count includes components from Qualcomm, MediaTek and other companies, and Android, being open source, is examined by more researchers.

How much does an iPhone or Android exploit cost?

Crowdfense (2024 price list, still current) pays up to $5-7M for a zero-click chain on iOS and up to $5M on Android. Russia’s Operation Zero pays $2M for iOS and $2.5M for Android. In 2019 Zerodium valued Android higher ($2.5M vs $2M).

How fast do Apple and Google patch vulnerabilities?

According to Google Project Zero (2019-2021), iOS needed an average of 70 days from report to patch, Pixel and Samsung 72 each. The difference is in how patches reach users: Apple updates almost its entire user base within a few months, while Android updates depend on the phone manufacturer.

Can an iPhone be hacked without a click?

Yes. Zero-click attacks (e.g. Paragon’s Graphite via iMessage in 2025, CVE-2025-43200) exist for both systems. Protection comes from Lockdown Mode (iOS), Advanced Protection (Android 16) and installing updates immediately. Apple says it knows of no successful spyware attack on a phone with Lockdown Mode enabled.

Why are Android accessibility features dangerous?

Accessibility services were created for people with disabilities, so they allow an app to read everything on the screen and tap on the user’s behalf. Banking trojans such as Anatsa, Herodotus or FvncBot, which targets Polish users, trick the victim into enabling this access and then steal passwords and make transfers themselves in the real banking app. Android 13 and newer make this harder for apps from outside the store, and Android 17 with Advanced Protection revokes this access from apps that aren’t accessibility tools. iOS doesn’t offer such an API to third-party apps.

Which phone should a company choose?

An iPhone or an Android with guaranteed 7-year support (Pixel 8+, Galaxy S24+), always under MDM, with enforced updates and a ban on installing apps from outside the store. For management and finance – Lockdown Mode / Advanced Protection.

Summary

For years this debate looked like sports fandom. The numbers show something both more boring and more interesting: at the source, Apple and Google play in the same league today – they patch at a similar pace, pay millions for holes, and their flagships have become targets only nation states can afford. The differences lie further down the line: in how many phones actually get the patch, where users install apps from and who is holding the phone. The iPhone wins with people who don’t configure. Android wins with companies that do – provided they bought a phone with support. And the one who always loses is whoever doesn’t update. 🔓

If you want to see how your mobile app or phone fleet looks from an attacker’s perspective – you know where to find me.

Data sources used in this post

• StatCounter – mobile OS market share worldwide and in Poland (09.2026)
• Google – Pixel update policy (support.google.com); Samsung / 9to5Google – 7 years of support for the Galaxy S25 (01.2025); Apple – iOS 26 security content (09.2025)
• Zimperium – Global Mobile Threat Report 2025 (04.2025) and announcement of the 2026 report (07.2026)
• Google Security Blog – “Eliminating memory safety vulnerabilities at the source” (09.2024); Google – “Rust in Android: move fast and fix things” (11.2025)
• Apple Security Research – “Memory Integrity Enforcement” (09.2025); “A major evolution of Apple Security Bounty” (10.2025)
• Google Threat Intelligence Group – “2024 Zero-Day Trends” (04.2025) and “2025 Zero-Day Review” (03.2026); SecurityWeek – summary (03.2026)
• Google Project Zero – “A walk through Project Zero metrics” (02.2022); Reporting Transparency 2025 (as of 17.03.2026)
• Android Security Bulletin – July 2025 and December 2025; Android Authority – risk-based update system (09.2025); SecurityWeek (07.2025); BleepingComputer (12.2025)
• Help Net Security – Apple’s first Background Security Improvements (03.2026); Apple / 9to5Mac – iOS 26.7.1, CVE-2026-86950 (28.09.2026); Android Security Bulletin – October 2026; MacRumors – iOS 27 release (09.2026)
• Apple / MacRumors – iOS 26 adoption (06.2026); Google / 9to5Google – Android version distribution (01.2026); StatCounter – Android versions (09.2026)
• Crowdfense – Exploit Acquisition Program; TechCrunch (04.2024); Operation Zero – price list (opzero.ru); TechCrunch (09.2023); Threatpost – Zerodium (09.2019); CyberScoop / The Hacker News – the Peter Williams case (2025-2026)
• Zero Day Initiative – Pwn2Own Ireland 2024, 2025 and 2026 results; BleepingComputer (09.10.2026); Privacy Guides (13.10.2026); SecurityWeek (10.2024)
• Google – VRP 2024 (03.2025) and VRP 2025 (03.2026); SecurityWeek – breakdown by program (03.2026) and Android VRP changes (05.2026); Samsung Newsroom (11.2024)
• Apple Newsroom – App Store fraud prevention 2025 (05.2026); Google – “How we kept Google Play safe in 2025” (02.2026)
• Kaspersky Securelist – “Mobile malware evolution in 2025” (03.2026) and 2024 (03.2025); Lookout – Q3 2025 Mobile Threat Landscape; Lookout / Business Wire (04.2025, 01.2026); ESET Threat Report H2 2025 (12.2025)
• CERT Polska – analyses of NGate (11.2025), FvncBot (03.2026), Cifrat (04.2026)
• Android Developers Blog – developer verification (08.2025, 06.2026); TechCrunch – alternative app stores in the EU (03.2025); Apple – app distribution in the EU
• Google – “How Android provides the most effective protection…” (10.2025, study commissioned by Google)
• Citizen Lab – Report 186, Paragon Graphite (06.2025); Apple Support – threat notifications; The Hacker News (08.2026); TechCrunch – Lockdown Mode (03.2026); The Record / Unit 42 – LANDFALL (11.2025)
• 404 Media / TechSpot – Cellebrite leaks (07.2024, 10.2025); Android Authority (10.2025)
• Google Project Zero – “A deep dive into an NSO zero-click iMessage exploit” (12.2021) and “FORCEDENTRY: Sandbox Escape” (03.2022); SecurityWeek (12.2021)
• Kaspersky – Operation Triangulation (06.2023); Securelist – “The last (hardware) mystery” (12.2023)
• Citizen Lab – BLASTPASS (09.2023); Apple – Lockdown Mode (Newsroom 07.2022, Personal Safety User Guide)
• Group-IB – GoldPickaxe / GoldFactory (02.2024)
• ThreatFabric – SecuriDropper (11.2023), Octo (04.2022), Crocodilus (03.2025), Anatsa (07.2025), Herodotus (10.2025); BleepingComputer – Anatsa (02.2024); The Hacker News – Hook v3 (08.2025)
• Google Security Blog – Android 15 and Play Protect live threat detection (05.2024); Android Developers Blog – accessibility API protections (12.2025); The Hacker News – Android 17 Advanced Protection and accessibility (03.2026, 10.2026)
• Intel 471 – FvncBot (12.2025); CERT Polska – FvncBot analysis (03.2026)