Without CVEs, Google’s monthly Android security bulletins may face delays, confusion, or reduced transparency. It’s unclear who, if anyone, will step in to maintain or replace the CVE system.

This change to private development doesn't come out of the blue—Android feels less open today than it did in the early days. For example, Google has been moving Android features from AOSP into ...