This article explains Google Security Patches

Because Android operating systems are maintained ultimately by Google, each month Google publishes an Android Security Bulletin which contains a list of known CVEs for a corresponding month. You can find the Android Security Bulletin here: https://source.android.com/security/bulletin/. Along with each monthly bulletin, Google and the related hardware vendors will provide security patches for each CVE which then needs to be integrated into the OS to mitigate the known security risk. 

See related articles:

• Managing Android OS Security Updates with OS 360 - FAQs
• Acronym: CVE – Common Vulnerabilities and Exposures