Loading story…
Google is adding six security capabilities to Android 17’s Advanced Protection suite to make targeted compromise and spyware activity harder to conceal. The most significant addition, Intrusion Logging, records security, network, and app-activity events in tamper-resistant encrypted logs, retains them in Google cloud storage for up to 12 months, and lets users decrypt and share evidence with trusted security experts.
The expanded protections also block USB data connections while a device is locked, restrict unverified AccessibilityService applications, disable Chrome WebGPU, and incorporate Failed Authentication Lock. The controls are designed to reduce exposure to physical-access attacks, fraud, malicious accessibility-service abuse, and sophisticated browser exploitation; feature availability will vary by Android device.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Google added six security capabilities to Android 17 Advanced Protection, including optional Intrusion Logging, USB data-connection protection while locked, accessibility-service restrictions, Chrome WebGPU disabling, and Failed Authentication Lock on selected devices. Availability varies by device, and existing Advanced Protection users will be notified as capabilities become available.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google has released **Android 17**, publishing the source code to AOSP under the tag `android-17.0.0_r1` and beginning rollout to supported Pixel devices, with broader availability planned across OEMs including HONOR, Lenovo, OnePlus, OPPO, vivo, Xiaomi, and others. Google also made **Generic System Images** available for `ARM64` and `x86_64`, while the platform adds major usability and device features such as foldable enhancements, App Bubbles, Handoff support, VVC/H.266 video, RAW14, HE-AAC, BLE hearing-aid improvements, and OpenJDK 25 integration. The release introduces a broad set of security and privacy changes, including tighter controls for **contacts**, **location**, and **local network** access, expanded one-time-password handling beyond SMS, stricter restrictions on **dynamic code loading**, stronger lost-device protections, improved threat detection, enhanced **Advanced Protection**, and stricter PIN retry limits. Google also added Certificate Transparency-related enhancements, support for **HPKE** cryptography and **ML-DSA** APK signatures, and continued restrictions on cleartext traffic, alongside Pixel-specific updates delivered through the June Pixel Drop.
Jul 12, 2026
Google announced updated **Android Theft Protection** capabilities aimed at reducing account takeover and financial fraud risks following device theft, with availability starting on devices running **Android 16+**. The updates strengthen authentication safeguards by making **screen lock guessing** harder (longer lockout periods after repeated failed PIN/pattern/password attempts) and by improving controls around lock behavior after excessive failed authentications, including a dedicated settings toggle for *Failed Authentication Lock*. Google also expanded **Identity Check**—which requires biometric authentication for sensitive actions when the device is outside trusted places—to cover a broader set of actions and apps that use the **Android Biometric Prompt**, including third-party banking apps and **Google Password Manager**. In parallel, Android’s *Remote Lock* capabilities were highlighted as part of the theft-response toolset, giving users more control to lock a lost or stolen device and limit further misuse.
Jun 29, 2026
Google added a new safeguard in **Android 17 Beta 2** that blocks apps not classified as genuine accessibility tools from using the **Accessibility Services API** when **Android Advanced Protection Mode (AAPM)** is enabled. The change is intended to reduce a long-standing abuse path used by Android malware, which has leveraged accessibility permissions to read screen content, capture keystrokes, click through prompts, grant permissions, install additional payloads, and steal sensitive data including banking credentials. Under the new model, only verified accessibility apps marked with `isAccessibilityTool="true"` can retain this level of access. The restriction expands AAPM’s opt-in hardened security posture, which already includes controls such as blocking installs from unknown sources, limiting USB data access, and requiring Google Play Protect scanning. Google said developers can use the **AdvancedProtectionManager** API to detect whether the mode is active and adjust application behavior accordingly. The policy also narrows which app categories qualify as accessibility tools, with examples including screen readers, switch-based input, voice input, and Braille access software, while categories such as antivirus tools, automation apps, assistants, monitoring apps, cleaners, password managers, and launchers are not treated as accessibility tools for this exemption.
Jun 29, 2026