A recent vulnerability report by Google offered interesting statistics about in-the-wild exploitations from the last year, while also highlighting the long-standing problem was known zero-day flaws that don’t have patches released in a timely manner. Overall, while 2022 saw a 40% drop in the number of discovered zero-days from 2021, it may not be as big of a win for improving security as it might first appear. The starkest development revealed from 2022 was the way zero-day vulnerabilities act as n-days for threat actors on Android. An n-day vulnerability refers to a software flaw that is known to the public for “n” days with or without a patch. The discrepancy for how the zero-days act is caused by a gap in the Android ecosystem between upstream vendors (Google) and downstream manufactures (phone manufacturers) where a vendor will fix a bug upon discovering a zero-day vulnerability, but it can take months for the downstream device manufacturers to implement the available patch in their own versions of Android. Hence, zero-day vulnerabilities that have been discovered can act as n-day vulnerabilities that are publicly known without having a patch, leaving vulnerabilities open to exploitation until the patch is finally rolled out by manufacturers. While upstream/downstream gaps exist, the trends were found to be more prevalent and longer lasting in Android. Other findings from the 2022 vulnerability report included a development in response to security improvements made by browser providers where threat actors are moving towards zero-click vulnerabilities that target device components and don’t require victims to click on anything be compromised. While security experts said they knew of multiple attackers using zero-click exploits, there were no known in-the-wild zero-clicks publicly recorded in 2022. However, this may be due to the fact that they are very difficult to detect as compared to traditional device compromises. Additionally, around 40% of zero-day vulnerabilities that were discovered in-the-wild in 2022 were variants of previously reported vulnerabilities.