See also the observations in T195880 (note: "none" != "unknown")

It does coincide with an upgrade, right? All those chrome mobile views are coming from Android and Android 8 overtakes all other versions about when. 8.0 was released (August 21st is public release, until then it was in beta) https://en.wikipedia.org/wiki/Android_Oreo

You can see how Android8 deploy progresses and thus increases the presence of more proper referrers:

https://bit.ly/2rri1eA

https://bit.ly/2SvSZ9R

While android 8 plays a factor you can also see below Android 8 referrers switching from unknown to "search engine" at about Sep 9th so there is more to this:

If you split by country you call tell this sharp decline is not so sharp in India, which points to an upgrade of some sort (the google app?) as upgrades are slower in India than other countries

https://bit.ly/2PswS22

While change seems sharp on the 12 months plot it actually happens in the course of couple weeks from September 9th to September 22nd. The fact that is only present on Android Chrome mobile and that (see above) the change is slower in some countries in which we know upgrades are slower points to a security patch or upgrade on Android. The android security patch released on sep 9th: https://forums.androidcentral.com/google-pixel-2-pixel-2-xl/907638-september-2018-update-6.html matches pretty well in terms of dates so I bet that is the root cause of the shift.

See patches:

https://source.android.com/security/bulletin/2018-10-01.html

Closing ticket, added note to : https://wikitech.wikimedia.org/wiki/Analytics/Data_Lake/Traffic/Webrequest#Changes_and_known_problems_since_2015-03-04