Is there a documented life cycle for which Android versions receive security updates?

Question

Is there any official life cycle for Android versions in terms of which versions receive security patches each month?

If you look at the latest security bulletin it appears 8.0 is still receiving patches but I would like to know for how much longer that will be the case.

The table on this Wikipedia article lists all version prior to 9.0 as unsupported but the citations for these rows just link to the marketing site for that version of Android and I couldn't find any information about security patches there.

Note: I understand that actually getting updates to devices depends on manufacturers and carriers and is in no way guaranteed to match Google/AOSP, I'm just looking for official word from Google/AOSP on when they will stop pushing security bulletins to a given version of Android or a list of which versions are still supported other than just looking at the versions on the latest bulletin.

Answer 1

It appears there is no official policy in place for how long a specific version is supported and no official announcement when support is dropped. Looking back through the security bulletins it appears to be consistently around 3 years after initial release that security patches stop being applied so this estimate is probably the closest thing to an answer at this point.

Average Lifespan in years as of April 2024: 3.26

OS	API	Release Date	Last Security Update	Estimated Last Security Update	Life Span (Years)
14	34	2023-10-04		2027-01-07
13	33	2022-08-25		2025-11-18
12L	32	2022-03-07		2025-06-10
12	31	2021-10-04		2025-01-07
11	30	2020-09-08	2024-02-01		3.40
10	29	2019-09-03	2023-02-01		3.42
9	28	2018-08-06	2022-01-01		3.41
8.1	27	2017-12-05	2021-10-01		3.82
8	26	2017-08-21	2021-01-01		3.37
7.1	25	2016-12-05	2019-10-01		2.82
7	24	2016-08-22	2019-10-01		2.94
6	23	2015-10-05	2018-08-01		2.82
5	22	2014-11-12	2018-03-01		3.30

Answer 2

The decision about security related update-support lies by the manufacturers. But Google can mandate the manufactures in contract to provide update support for a certain amount of time, but I don't think that this is public information.

Anyway, I've found this article from 2018, stating that Google mandates the manufacturers to provide 2 years update support for popular devices.