Despite gaining ground, Google's newest version of Android is still a minority system, eight months after it was released. It's growing more slowly than Lollipop, which reached 10 percent at this time last year.
However, as noted byAndroid Police, Marshmallow was the only version of Android to grow while nearly every other version shrank.
And that's good news on the Android security front. As Google noted in its annual Android security report, last year it didn't provide security fixes for 30 percent of Android devices. Google only offers patches for Android 4.4.4 KitKat and above in its monthly security updates for Nexus devices, which are also shared with Android partners.
But as of May, the share of Android devices that will never receive a patch has fallen to 25 percent. Most of the unpatched products are running Android Jelly Bean, which accounts for 20.1 percent of all Android devices. Earlier versions down to Android 2.2 Froyo account for the remaining 4.9 percent.
Google this week also decided to rename its monthly Android security notice from the Nexus Security Bulletin as the Android Security Bulletin to reflect its status as addressing vulnerabilities that may affect all Android devices and not just Nexus ones.
Google provides Android partners with the bulletin about a month before it publishes the notice, giving them time to prepare the updates for specific models. But until this month, the only firm to line up its patching with Google's Nexus updates is BlackBerry for its Priv devices.