Agreed, placing all the blame on Google is not fair. Besides Google, carriers, and manufactures, there's one more party involved that no one seems to talk about, users. Google only promises to update their software for 18 months. If you're going to milk years and years out of your smartphone, don't you have some responsibly to update outdated apps with updated ones from the Google Play store?

I have an old Galaxy S3 that Samsung no longer updates, yet these bugs don't effect me because I've replaced the built in browser with Chrome, which still receives regular security updates. What's stopping users of old phones from installing Chrome or Firefox?