Android has unveiled a new set of libraries allowing apps and enterprise tools to determine if a device is missing critical security patches across its system parts—not just looking at one broad patch date. This offers far more detail than the single “Security Patch Level” users currently see in settings.
What’s inside the new Security State libraries
The update introduces AndroidX Security State version 1.1.0 and Security State Provider 1.0.0. Designed for apps in finance, healthcare, telecom, and enterprise mobility, these libraries let developers check not only whether critical system updates have been applied, but also the patch status of system modules and the Linux kernel. This goes well beyond the traditional monthly patch date, which can miss component-specific vulnerabilities. Published Security Patch Level, Device Security Patch Level, and Available Security Patch Level are now tracked separately for system components, system modules via Google Play, and kernel versions via long-term support channels.
Manufacturers will also be able to report backported fixes using a new Supplemental Patches XML format so apps can recognize when a fix was supplied before the monthly date update rolls out.
How apps can use this for real-world security
With finer-grained visibility into patch status, apps can incorporate smarter security checks. For example, a banking app could refuse high-value transactions if the kernel patch for a known exploit isn’t applied yet. Enterprise tools could block access to sensitive resources unless Bluetooth or NFC vulnerabilities are patched. Rather than flat-out denying access, apps can also guide users to install updates when they’re available but not yet applied.
The systems integrate with the Android Security Bulletin and the OS’s vulnerability database to cross-check which patches are applicable—even if those patches weren’t listed in a monthly update because the component wasn’t impacted at the time. The libraries also link with Google Play system updates and device manufacturer over-the-air (OTA) frameworks so updates already staged for installation can be identified.
This delivers meaningful change for device security. Rather than trusting a single date, apps and management tools can inspect the exact security posture of each part of the system. That helps protect against scenarios where a device’s OS has been updated but a modular component or the kernel remains vulnerable.
Why this matters: Android’s fragmented update model—OEMs, Play Store modules, kernel versions—has long made it hard to know whether a device is fully protected. These updates bring clarity, letting security-conscious apps make risk-based decisions. Look out for your banking, enterprise, and healthcare apps adding stricter checks—with the potential tradeoff that actions may be blocked until your phone is fully patched.
