So what does this mean for security?<p>Since its inception, Chrome OS has made security a focus and put a large amount of work into it, everything from bootloaders to Linux kernel features such as seccomp-BPF and KASLR, to complement the existing high security of Chrome itself. It also borrows Chrome's silent and fast update mechanism, allowing for frequent security updates. Its sandbox may feel somewhat limiting, but for those who do manage to stay within it, Chrome OS is probably the most secure desktop platform in common use.<p>Meanwhile, even if Android's update issues were somehow solved, it has a pretty bad security reputation even apart from that, with a long list of historical vulnerabilities which could be basically said to stem from a lack of priority given to it (e.g. from designs which, while not <i>inherently</i> insecure, unnecessarily open up attack surface that could be eliminated with a better design, such as in the case of the "master key" vulnerabilities; or just from crappy code, such as binder - whether caused by lack of auditing or just lack of security awareness among its authors I don't know, but both can be considered part of making security a priority). Maybe things have gotten better, and I don't have that much experience with Android, but there is simply no comparison between the general Android app sandbox (which allows native code) and what you get under Chrome with NaCl and such. The latter isn't perfect (as I know, because I've exploited it repeatedly), but the attack surface to examine for bugs is just much smaller than on other systems. I'm not really giving it any justice with this brief description.<p>I guess that if you're especially worried about security you could just only use Chrome on Android, and not install or use any other apps, and that would get you most of the way there. Indeed, if you do so, you can still have access to the Chrome Web Store's paltry selection of apps - it's cross-platform, you don't <i>have</i> to go for the OS designed around it...<p>But essentially nobody will do that. And even if they did, the recent Stagefright vulnerabilities demonstrate the difficulty of accounting for every potential attack surface on an OS, and thus the benefit of having the OS engineers design the lockdown rather than the user coming up with something ad-hoc. (Plus, today at least, even under Chrome's sandbox, Android's version of the Linux kernel is not as secure as Chrome OS's. And again, this is all assuming Android slow update problem is solved, which is a pretty big assumption considering how long it's been around; if it isn't, that's already enough to basically doom platform security.)<p>So if Chrome OS is really folded into Android, the end result, I think, will be the destruction in practice of something that was really quite unique in the security world. Maybe I shouldn't be so pessimistic - after all, those same security engineers could now work on Android. But I am, because even if work is done on it, the platform just comes from such a different place that it would be hard to make the same.