How to keep an Android Service running?

I have four questions about Android security - can anyone help me?

• 1. With Android devices, do both the OS AND the web browser--whichever web browser the user is using--need to be kept up-to-date to protect against web-based exploits, or is that accomplished solely by keeping the web browser up-to-date? My reason for asking this is I was given an old phone running Android 2.2 and the phone is only update-able to Android 2.3.  I know that Chrome won't run on it, but I figured if I could find and download a different web browser that was modern and kept up-to-date by its manufacturer to protect against security threats... that's why I need to know whether you have to keep both the browser AND the OS up-to-date to protect you from web-based exploits. If I buy a phone that runs a manufacturer-customized version of Android, such as the TouchWiz version of the S4 or the Note II, will keeping whatever web browser I choose to use up-to-date keep me safe from web-based exploits, even if that phone’s manufacturer is slow to deliver updates to the OS? 2. Is Android’s stock browser updated directly by Google, or do updates to it have to go through phone manufacturers (Samsung, HTC, etc.)?  And is it updated as often as Chrome is, or is it only updated whenever Google updates Android? 3. I’ve read that in-app advertising can be a security risk. I’m really hoping that someone here will explain this to me. 4. Can antivirus software for Android plug vulnerabilities in out-of-date versions of Android?

• Answer:

  Is Security dependent on Android version and manufacturer software maintenance? Yes. I'm sure you wouldn't hope so, but it's true. However many apps with security vulnerabilities are updated via Google Play, but the core os only receives updates with new Android releases. Can stock browser be updated independently? Yes. There are not many manufacturers I know of that alters or replaces the stock browser. Is In-App advertising a Security risk? That depend on how you see it. I'm sure there is more to this story. I've read up on this and it's because of remotely downloaded ad-libraries etc.