Cybersecurity
Android 17 restricts accessibility services under Advanced Protection
Google said Android 17 would limit AccessibilityService access to verified accessibility tools when Advanced Protection is enabled, while also adding several other security features and forensic options.
- Google announced that Android 17 will allow AccessibilityService access only to verified apps classified as Accessibility Tools when Advanced Protection is turned on.
- The company said the change was intended to close an attack route that malicious Android apps had used for malware and financial fraud.
- Google said accessibility services can run in the background, intercept interface events, and act on a user's behalf.
- Android 17 also adds Intrusion Logging, USB Protection, Disable WebGPU, Failed Authentication Lock and View Supporting Apps.
- Google said developers can be told when Advanced Protection is enabled, and users can manually switch on Intrusion Logging in settings.
Google announced a new Android 17 security measure that restricted AccessibilityService access to verified applications classified as Accessibility Tools whenever Advanced Protection was enabled. It said the move was meant to block an attack route while keeping assistive technology available.
The article said the AccessibilityService API let an app run in the background, handle user interface events and interact with other applications on the user's behalf. It also said that banking trojans and spyware had abused that access to steal data and carry out malicious actions without root access.
Google said attackers could abuse accessibility services after tricking users into granting the permission. It said that could be used to start fraudulent transfers, record keystrokes, overlay fake sign-in screens and grant further permissions.
The article also listed other Android 17 additions: Intrusion Logging, USB Protection, Disable WebGPU, Failed Authentication Lock and View Supporting Apps. Google said developers could be notified when Advanced Protection was enabled, and users could enable Intrusion Logging from the settings page.
Named in this story
Companies
- announced the change and described the security rationale
Products and systems
- Android 17
- received the new accessibility restriction when Advanced Protection is enabled
- Advanced Protection
- security setting that activates the restriction on accessibility access
- Android AccessibilityService API
- framework that lets apps interact with the screen and other apps
- Google Play Protect
- security feature mentioned in the list of protections
- Android Advanced Protection Mode (AAPM)
- mode used to prevent some apps from using the accessibility services API
- Intrusion Logging
- new forensic logging feature in Android 17
- USB Protection
- new protection against access through a physical USB connection
- Disable WebGPU
- new option that reduces exposure to browser-based exploits
- Failed Authentication Lock
- new lock-down feature against tampering and brute-force attempts
- View Supporting Apps
- new feature that shows which apps checked Advanced Protection status
- accessibilityDataSensitive flag
- developer flag for marking sensitive views
How the source tells it
The source was a straightforward technical security announcement, with most of its colour coming from Google's own framing of the risk.
No emotive framing was found in the original.