The previously undisclosed move could leave some users with older phones exposed to snooping by hackers and spies, security researchers said.
The new policy applies to the default browser in Android version 4.3, released in mid-2013 and known as Jelly Bean, and earlier. That covers roughly two-thirds of the billion-plus Android devices in use, according to Google, but some users may have updated their browsers to newer versions.