Google has substantially fortified its Advanced Protection protocols within the Android ecosystem. A singular, unified mode now strictly constrains USB data transmission, barricades hazardous access to accessibility features, completely disables WebGPU within Chrome, and meticulously archives security logs for up to a year. Intrusion Logging and Cloud Security Among the most paramount enhancements is Intrusion Logging, an intricate mechanism that records critical security events and nuanced network activity.

Google is tightening restrictions on one of mobile malware's most persistent entry points. With Android 17, the company is limiting access to its AccessibilityService API to verified Accessibility Tools only, a change that takes effect the moment a user switches on Advanced Protection. The move, announced Thursday, targets a problem that has haunted Android security for years. The AccessibilityService API was built to help people with disabilities use their smartphones. Screen readers, voice control apps, and motor-assistance tools all rely on it. But the privileges it carries are significant. Apps that tap into the API can run in the background, observe what appears on screen, intercept UI events, and take actions inside other applications on a user's behalf. That set of capabilities made it a target for malware developers almost immediately after it was introduced. Google stated in its announcement that the new version automatically restricts AccessibilityService access to verified Accessibility Tool applications, closing off a major attack avenue while keeping genuine assistive technology functional. A Clichéd Attack Path Malware families have been weaponizing Android's accessibility services since at least 2017. The list of known offenders runs long: Vultur, SharkBot, Xenomorph, BianLian, Anatsa (also tracked as TeaBot), and more recently BTMOB RAT, a remote access trojan documented attacking banking customers across Brazil, Argentina, Spain, Portugal, and Mexico through 2025 and 2026. According to Kaspersky data, trojans accounted for 40 percent of Android malware infections in Q1 2025, with nearly 12 percent of malicious apps falling into the banking trojan category that specifically abused the Accessibility API, totaling around 154,000 apps. The attack chain is well understood. A malicious app, typically distributed through sideloaded APKs or disguised as something routine, tricks a user into granting accessibility permissions. The Anatsa trojan, for instance, slipped onto Google Play as a PDF viewer update as recently as July 2025. Once the permission is granted, the malware operates without root access. It can monitor keystrokes, layer fake login pages on top of legitimate banking apps, approve system dialogs silently, and initiate fraudulent fund transfers from financial applications without the user noticing anything unusual on screen. Google noted in its announcement that this access also allows malware to block its own uninstallation, locking users out of any easy remedy. What Changes in Android 17 The new restriction applies specifically when Advanced Protection is active, a device-level security mode introduced with Android 16 that consolidates multiple hardening features under a single toggle. When a user enables it, the system now automatically enforces that only verified, legitimate accessibility apps can request AccessibilityService access. Everything else is denied. This is part of a gradual tightening that has been underway for several years. Android 13 made it significantly harder for sideloaded apps to acquire accessibility permissions. In-call protections, rolled out more recently, prevent users from granting those permissions during a phone call, cutting off a common social engineering scenario. Google also introduced the `accessibilityDataSensitive` flag to let developers mark UI elements as off-limits to third-party accessibility readers. The Rest of Android 17's Security Updates The accessibility change is one piece of a wider hardening effort in Android 17. Intrusion Logging, developed in collaboration with Amnesty International's Security Lab and other civil society organizations, creates a persistent, privacy-preserving forensic record of sensitive system events. Amnesty's team simultaneously updated AndroidQF and its Mobile Verification Toolkit to process the new log format, making it immediately useful for researchers investigating suspected spyware infections. USB Protection blocks new data connections over a USB port while the device is locked, preventing physical access attacks where an attacker might attempt to extract data or push commands through a connected cable. Google has also included an option to disable WebGPU, a graphics API that has surfaced in sophisticated browser-based exploit chains. Failed Authentication Lock responds to repeated incorrect login attempts by locking the device entirely, making brute-force attempts against a stolen or seized phone substantially harder. A fifth addition, View Supporting Apps, gives users a clear window into which installed applications have checked whether Advanced Protection is active on the device. For developers, Google confirmed that applications can receive a notification when a user enables Advanced Protection, allowing them to switch on their own high-security features automatically for that audience. Existing Advanced Protection users will receive a notification when the new capabilities land on their device. Intrusion Logging is not switched on by default and must be enabled manually from the Advanced Protection settings page.

Google is adding six new Advanced Protection features to Android 17, including encrypted Intrusion Logging that stores tamper-resistant forensic evidence in Google’s cloud for suspected spyware investigations. The update also strengthens device and browser defenses, restricts risky accessibility app access, and gives users more transparency over supporting apps and security settings. #Android17 #AdvancedProtection #IntrusionLogging #Google #Chrome #AmnestyInternational

Google has added six new Advanced Protection features to Android 17, including optional Intrusion Logging that stores tamper-resistant forensic evidence off the device for later analysis. The update also strengthens device, browser, and app defenses with USB Protection, accessibility restrictions, WebGPU blocking, and Failed Authentication Lock. #Android17 #AdvancedProtection #IntrusionLogging #Chrome #WebGPU

Key tekeaways   Android 16, de nieuwste update van het besturingssysteem van Google, is nu beschikbaar voor compatibele Pixel-apparaten. Deze uitrol markeert het begin van een bredere beschikbaarheid van Android 16, waarbij andere telefoonmerken de update later dit jaar zullen ontvangen. De update bouwt voort op Google’s Material 3 Expressive design filosofie, legt de nadruk […]

Google is sharing more information on how Chrome operates when Android mobile users enable Advanced Protection, highlighting strong security improvements.

Fortify Your Phone: Android 16's Advanced Security Features In this episode, we'll explore two of the most impactful security features in Android 16 that you need to know about: Advanced Protection and Identity Check, along with other significant API security improvements. Key Features and Insights: - Android 16's Focus on Security: Despite foundational work for future design and multitasking changes, Android 16's initial rollout emphasizes "significant security enhancements" designed to make a "meaningful difference" in data protection. Android 16 sets the stage for the platform's most dramatic reinvention in ages, and while some elements are part of a future update, this new software features a slew of significant security enhancements. The Android 16 Security Release Notes, published June 10, 2025, detail vulnerabilities addressed in this version. Devices with a security patch level of 2025-07-01 or later are protected against these issues. The Android security team actively monitors for abuse through Google Play Protect, which is enabled by default on devices with Google Mobile Services, and warns users about potentially harmful applications. - Advanced Protection: This is a new, all-encompassing Android security "supermode" activated by a single switch within your system settings. On Google Pixel phones, it's an added section within the main Security & Privacy settings. Enabling Advanced Protection simplifies the process of activating a bundle of advisable Android security settings at once, rather than requiring you to find and enable them individually. - Bundled Safeguards: Advanced Protection activates a suite of protections, including: - Extra theft protection: Utilizes Theft Detection Lock and Offline Device Lock, which were introduced previously, to automatically lock your device if it detects it's fallen into the wrong hands. - Enhanced app protection: Ensures Android's Google Play Protect on-demand scanning system is in place, restricts app installations to official Play Store (and any other preloaded app stores), and incorporates Memory Tagging Extension, making it less likely for an app to corrupt your device's memory. - Smarter web protection: Provides live scanning for browser-based threats, forces the more secure HTTPS encrypted web standard, and adds additional protections around Javascript processing within Chrome. - Advanced calling and messaging protection: Offers real-time scanning and warnings about likely scams and spam within Google Messages, detects and warns about unsafe links in incoming texts, and includes spam detection, scam detection, and call screening systems for incoming calls in the Google Phone app. - Heightened network protection: Actively rejects any less secure 2G-level network connections that may come along over time. This feature can also be individually activated to disable 2G connections. - Future Updates: Google's goal is to keep Advanced Protection updated with all the latest Android security features over time, so once activated, you don't have to manually enable new options as they arrive. Confirmed upcoming features expected "later this year" include: - Inactivity Reboot: Automatically restarts your device if it remains locked for 72 consecutive hours, re-encrypting all data to require a full password or pattern unlock. - Intrusion Logging: Securely stores encrypted logs of sensitive system actions in the cloud, connected solely to your Google account, for investigating suspicious activity. - USB Protection: Sets your phone's USB port to allow only charging by default, preventing unauthorized data transfers via physical connection. - Disable Auto-Reconnect to Insecure Networks: Your phone will not automatically reconnect to networks that are not secure, even if you manually connected to them once. - Identity Check: This feature, gaining prominence with Android 16, requires biometric authentication (e.g., fingerprint, face unlock) to access critical security settings or sensitive information like saved passwords, especially when your device is outside of a designated "trusted location". While you can set trusted locations where biometrics aren't required, for maximum security, it's recommended not to add any. The feature should be enabled by default but can be found by searching for "identity check" in your Settings app. - Overall API Security Weaknesses: Android 16 introduces several enhancements that directly improve mobile API security. - Intent Redirection Protection: Android 16 features stronger security against Intent redirection attacks, which are a common vulnerability where malicious applications can intercept or manipulate Intents. Developers are encouraged to test their Intent handling and should only opt out of these protections if it's absolutely necessary. - Local Network Permission: For apps targeting Android 16 or newer, a new permission is required to access the local network. This enhances privacy and security by restricting unauthorized network access. - More Granular Permissions: Android 16 introduces more granular permissions for sensitive data, such as body sensors. This means apps must explicitly declare their need for specific health-related data, giving users more control and enhancing data privacy. - Dynamic Code Loading Restrictions: The new version tightens rules around dynamic code loading, making it more difficult for apps to download and execute potentially malicious code after they have been installed. - Predictive Back Navigation: Although primarily a user experience feature, the changes to predictive back navigation and the deprecation of onBackPressed could indirectly impact how developers manage back events, potentially reducing certain vulnerabilities linked to navigation manipulation if implemented correctly. - Complementary Protections: It's important to differentiate between Android 16's Advanced Protection (for your device) and Google's broader "Advanced Protection" program (for your Google account). The latter is more intense, requiring physical security keys for account sign-ins and severely limiting third-party app access, making it more suitable for high-profile or at-risk individuals. However, these two programs are designed to be complementary, offering heightened protection for both your device and your Google account when used together. It is recommended to enroll your Google account in Advanced Protection and confirm a recovery email. - Beyond Advanced Protection: Even with these significant updates, ongoing security requires "common sense and careful thinking". Regularly reviewing your Android security settings with a comprehensive checkup is crucial, ideally at least once annually. Android 16, as the latest Android version, is rolling out automatically in the coming months, though schedules can vary by device and manufacturer. You can check your device's Android version in Settings under "About phone" or "About tablet". Remember to update your device and activate these powerful security features to keep your phone and data safe!. Keywords: Android 16, Advanced Protection, Identity Check, mobile security, data protection, Google Pixel, privacy, Android updates, cybersecurity, smartphone security, Google Play Protect, theft protection, app security, web protection, calling protection, network security, API security, Intent Redirection, Local Network Permission, Granular Permissions, Dynamic Code Loading, Predictive Back Navigation. This episode is brought to you by Approov Mobile Security. For robust mobile app and API security solutions, visit www.approov.io.

تطرح جوجل رسمياً وضع "الحماية المتقدمة" (Advanced Protection mode) مع الإصدار التجريبي الأول الجديد من أندرويد 16 QPR1. وبعد أشهر من التسريبات والشائع