Is it safe to use an old Android phone as a security camera if it no longer gets security updates?
Short answer: it depends on a number most people have never looked at, and it is not the Android version. An Android phone has two independent update lines, not one. The manufacturer's line stops when the manufacturer decides it stops. The second line — Google Play system updates — kept running for years afterward on many devices, and it covers several of the components a camera actually leans on.
But that second line has its own cutoff, and it is documented in one sentence that almost nobody quotes. If your phone runs Android 11 or lower, both lines are now closed.
That single fact should decide where you mount the phone, what network you put it on, and whether the device is a reasonable camera or a permanent liability. Here is how to check yours in about ninety seconds.
Step 1: Read the three numbers your phone already shows you
Google's own instructions are to open Settings → About phone → Android version. The page says you'll find info about your Android version, Android security update, Google Play system update, and Build number.
Four fields. Three of them matter here, and people routinely conflate the middle two:
- Android version — the platform release (13, 14, 15…). This is the one everybody quotes and the least useful on its own.
-
Android security update — a date, like
2026-06-01. This is your manufacturer's line. If this date is old, your OEM has stopped or slowed. - Google Play system update — also a date, and a completely separate one. This is the second line.
Write down the two dates. The gap between them is the whole story.
Step 2: Understand what the second line actually covers
Android 10 introduced Mainline. In the platform documentation's words, Mainline "modularizes some Android system components and enables them to be updated outside of the normal Android release cycle," and devices "can receive Mainline updates from the Android Google Play system update feature (which runs on the Google Play Store infrastructure) or through a partner-provided over-the-air (OTA) mechanism."
Translated: Google can ship fixes for parts of the operating system straight through the Play Store, without your manufacturer lifting a finger.
The module list is public, and for a phone being used as a camera it is a notably well-aimed set. Among the modules, with the release each became updatable:
| Module | Package | From |
|---|---|---|
| Media (extractors, MediaSession) | com.android.media |
Android 10 |
| Media Codecs | com.android.media.swcodec |
Android 10 |
| Conscrypt (TLS) | com.android.conscrypt |
Android 10 |
| DNS Resolver | com.android.resolv |
Android 10 |
| Network Stack | com.android.networkstack |
Android 10 |
| MediaProvider | com.android.mediaprovider |
Android 11 |
| PermissionController | com.android.permissioncontroller |
Android 10 |
Look at what that covers: media parsing, video encoding and decoding, TLS, DNS, and the network stack. For a device whose entire job is to encode video continuously and answer requests on a network, those are close to the highest-risk surfaces it has.
One useful detail from the same page: module updates "don't introduce new APIs," and a module package "installs and rolls back atomically; either all modules that need to be updated are updated or none are updated." This line is deliberately conservative — it won't change how your phone behaves, which is exactly what you want on a device bolted to a wall.
Step 3: Find out which side of the line you're on
Here is the sentence that decides it, from the Mainline documentation, in full:
Note: Mainline support for Android 11 and lower is concluded as of Q4 of 2025.
So:
- Android 12 or higher → the second line may still be live even if your OEM has gone quiet. Check the Google Play system update date. If it is recent, real fixes are still arriving for the modules above.
- Android 11 or lower → both lines are closed. Nothing in the list above is being updated anymore, by anyone.
This is a sharper and more honest dividing line than "is it old?" A phone on Android 12 whose OEM abandoned it two years ago is in meaningfully better shape than a phone on Android 11 that got its last OEM patch more recently. The version number is the gate; the OEM date alone will mislead you.
If you have a Pixel, Google publishes the answer outright. Pixel 8 and later "get updates for 7 years"; Pixel 6, 7 and Fold get 5 years. And there is a flat, named list under the heading that these phones "no longer receive Android version updates and security updates" — Pixel 5a with 5G, Pixel 5, Pixel 4a (5G), Pixel 4a, Pixel 4, Pixel 3a, Pixel 3, Pixel 2, and Pixel 1. Those are precisely the phones sitting in drawers being volunteered for camera duty.
For everything else, Google's instruction is to ask the maker: update schedules "vary by device, manufacturer, and mobile carrier."
Step 4: Set the phone up so the answer matters less
Whichever side you land on, the same moves shrink what an unpatched component could even be reached through. None of this requires spending money.
- Don't give it an inbound path from the internet. No port forwarding, no UPnP, no "remote access" that opens a hole through your router. A camera that is only reachable from inside your own network is not exposed to the internet's background noise at all. If you want the reasoning in detail, we wrote it up in the LAN threat model for a phone-as-camera server.
- Don't put a valuable account on it. If the camera works without a cloud login, don't add one. An old phone with no credentials on it has nothing worth stealing from it.
- Take everything else off it. Remove apps you won't use. Fewer installed apps is less code running unattended on a device you never look at.
- Update what still can update. The Play Store, Play services, and app updates keep flowing regardless of OS support. So does the Google Play system update line, if you're on Android 12+. Leave automatic updates on.
- Put a real screen lock on it. The phone is mounted in a room. Physical access is a realistic threat, not a theoretical one.
- Keep it on Wi-Fi you control. If your router offers client isolation or a separate guest network, an unpatched device is a good candidate for it.
If your phone is on Android 11 or lower and you want to use it anyway, that is a defensible choice — but make it deliberately: no inbound ports, no accounts, nothing else installed, and ideally on an isolated network segment.
What the documentation does not tell you
Three honest gaps, stated plainly:
- The Mainline note gives a date and no consequences. "Concluded as of Q4 of 2025" tells you updates stopped. It does not enumerate which unpatched issues remain in those modules on those devices, and I'm not going to invent that list.
- Non-Pixel support windows aren't centrally published. Google's page routes you to your manufacturer. For many budget handsets there is no clear published window at all — the honest answer for those devices is "unknown," not "fine."
- A recent Google Play system update date doesn't mean everything is patched. Mainline covers the modules listed above. The kernel, device drivers, bootloader, and manufacturer code are not in that list and are not covered by that line.
Where Background Camera RemoteStream sits in this
Plainly: no camera app can patch your operating system, and ours doesn't claim to. What an app controls is how much it asks the phone to expose.
Background Camera RemoteStream records with the screen off and stores video locally on the device. It does not require a cloud account, so there's no credential sitting on an unpatched phone to be taken. Remote viewing runs through a small web server on your own LAN, which means the useful setup is the one that keeps the phone reachable only from inside your network. And it's a normal Google Play install, so the app itself keeps getting updates through the Play Store even when the OS underneath has stopped.
That's the honest scope: the app reduces what the phone has to be exposed to. It does not change what the phone is running.
What to do this week
Open Settings → About phone → Android version on the phone you're using, or planning to use, as a camera. Read the Android version and the Google Play system update date. If the version is 12 or higher and that date is recent, you are in better shape than the phone's age suggests. If it is 11 or lower, both update lines are closed — keep it off the open internet, keep it account-free, and decide with your eyes open.
Then go patch your main phone, which is a different job and the more urgent one — we covered that drill in Android Just Patched an Actively-Exploited Zero-Day. And if your camera phone is one you deliberately never touch, Android will eventually hibernate the app and reset its permissions unless you tell it not to — that trap is in The Camera App You Deliberately Never Open.
Background Camera RemoteStream — screen-off recording, local-only storage, live view over your own LAN, no cloud account required.
Google Play · superfunicular.com
Sources (all read directly, not from summaries):
Top comments (0)