Security researchers have discovered and reported 523 security bugs in Google’s Android OS in 2016. Oracle is 2016’s vendor with the most security bugs, followed by Google, with 698 security bugs. The company with the largest number of new security bugs has been assigned was Oracle, with 798 bugs reported in Oracle products such as MySQL, Solaris, and its custom Linux OS version. The rest of the top 10 is made up of Microsoft (492 bugs), Novell (394), IBM (382 bugs), Cisco (353 bugs), Apple (324 bugs)
Source: https://www.bleepingcomputer.com/news/security/android-was-2016s-most-vulnerable-product/