Loading story…
Google Play will require Android apps and games to meet new technical-quality thresholds for dynamic memory use, bitmap memory use, and DEX code optimization beginning in February 2027. Apps that fail to comply may face reduced Play Store visibility and publishing restrictions. Developers can use Play Console and Android vitals to identify memory consumption, out-of-memory terminations, and code-optimization metadata; Google recommends enabling R8 code and resource optimization in tested release builds, maintaining appropriate keep rules, and retracing obfuscated crash reports.
Starting in April 2027, Android apps with sign-in functionality must implement the Restore Credentials API to preserve account access during migration to a new Android device; games are initially exempt. The feature creates a restore key after authentication on the previous device, stores it through Android Backup when eligible, and restores it via cloud backup or USB device-to-device transfer, supporting passkeys, passwords, and Sign in with Google. It silently restores one account per app on mobile devices, reducing migration-related sign-in friction.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Google Play introduced Zero-Tap Sign-In for apps supporting user sign-in, requiring use of Android's Restore Credentials API to restore sign-in state when a user migrates to a new Android device. Games are initially exempt from this requirement.
Google Play added Play Console and Android vitals metrics for dynamic and bitmap memory consumption, a filter for memory-pressure-related crashes and ANRs, and DEX optimization insights for newly uploaded app bundles that provide optimization metadata.
Google Play introduced requirements covering dynamic memory use, bitmap memory use, and DEX optimization. It said apps and games that do not meet the planned thresholds could face reduced Play Store visibility and publishing capabilities when enforcement begins.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
developer.android.com
Open sourcedeveloper.android.com
Open sourcesupport.google.com
Open sourceandroid-developers.googleblog.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google has set **September 30, 2026** as the first enforcement date for new Android developer verification rules that tie app distribution to verified publisher identities. The initial rollout will apply to certified Android devices in **Brazil, Indonesia, Singapore, and Thailand**, where developers distributing apps through participating stores must complete identity checks through the Android Developer Console by submitting personal or organizational details such as legal identity, contact information, and in some cases a **DUNS** number. Google said the move is intended to make anonymous publication of malicious apps harder and improve accountability across the Android app ecosystem. The controls will extend beyond Google Play to participating marketplaces including **HONOR App Market, OPPO App Market, Samsung Galaxy Store, Palm Store, vivo V-Appstore, and Xiaomi GetApps**, with broader expansion planned in **2027**. Google is also adding APIs and a system service for app registration, verification checks, and bulk management through CI/CD workflows, alongside operational safeguards for APK testing and account management. After enforcement begins, only apps registered by verified developers will be allowed to install or update on certified Android devices in affected markets, though sideloading will remain possible through **Android Debug Bridge** or a new advanced installation flow for unverified developers.
Jul 12, 2026
Google said **Android 17** will begin a broad migration to post-quantum cryptography as part of a plan to harden the platform against future quantum attacks on public-key systems. The company is introducing quantum-resistant protections across core trust components, including **Android Verified Boot**, **Remote Attestation**, **KeyMint**, and **Android Keystore**, with support centered on the NIST-standardized `ML-DSA` algorithm. Google said the move is intended to build a quantum-resistant chain of trust spanning device boot, identity verification, and hardware-backed security services. Google also said **Google Play** will support hybrid app signing that combines classical and post-quantum signatures, and will begin generating quantum-safe `ML-DSA` signing keys for new apps while allowing existing apps to opt in. The company is targeting completion of its broader post-quantum migration by **2029**, citing the risk of **store-now-decrypt-later** attacks and warning that organizations should begin adopting NIST-developed PQC standards before fault-tolerant quantum computers can break current encryption. Google added that future Play updates are expected to support hybrid key upgrades and prompt developers to rotate signing keys every two years.
Jun 29, 2026
Google reported that its 2025 enforcement and review efforts blocked **over 1.75 million policy-violating app submissions** from being published on Google Play and resulted in bans of **more than 80,000 developer accounts** tied to harmful behavior. Google attributed these outcomes to expanded *AI-powered, multi-layered* defenses, including developer verification, mandatory pre-review checks, and testing requirements intended to raise the barrier for malicious or non-compliant apps and reduce user harm such as malware, financial fraud, hidden subscriptions, and privacy-invasive behavior. Google also said it prevented **over 255,000 apps** from obtaining excessive access to sensitive user data and that Google Play runs **10,000+ safety checks** as part of its protections, with detection strengthened by integrating newer generative AI models to help reviewers identify evolving malicious patterns. Additional ecosystem integrity measures cited include blocking **160 million** suspicious/inauthentic ratings and identifying large volumes of malicious sideloaded apps via **Play Protect**, which Google said scans hundreds of billions of apps daily and expanded “enhanced fraud protection” coverage broadly across Android devices, blocking large numbers of risky installation attempts.
Jun 29, 2026