Google is introducing stronger protection for Android’s AccessibilityService API in Android 17, by limiting access only to verified apps when Advanced Protection is enabled. This change is intended to block a frequently exploited attack vector used by malware and fraudsters. Advanced Protection is a high-security mode that activates Android’s most stringent defenses to guard against serious threats.
What’s Changing in Android 17
Starting with Android 17, enabling Advanced Protection means that accessibility features—like screen readers or voice control—will only be available through apps verified by Google as “Accessibility Tools.” This prevents unverified programs from using the AccessibilityService API, which grants powerful capabilities such as monitoring UI events or simulating user interactions.
Although accessibility services help users with disabilities, the permissions they require make them a tempting target. When misused by malware, they can do things like simulate taps, overlay fake login screens, steal inputs, or even facilitate unauthorized fund transfers—all without needing root access on the device.
Other New Security Enhancements
Beyond tightened controls on accessibility tools, Android 17 introduces several additional layers of protection:
- Intrusion Logging: Persistent log mechanisms designed to help investigate complex spyware attacks while respecting user privacy.
- USB Protection: Measures to prevent access via physical USB connections unless explicitly allowed.
- Disabled WebGPU: Disabling WebGPU support to reduce exposure to emerging browser-based exploit techniques.
- Failed Authentication Lock: Locking down the device entirely on repeated failed authentication attempts, to block brute force or physical tampering.
- View Supporting Apps: A UI feature letting users see which installed apps are permitted to query the Advanced Protection status.
Developers with tools intended for users under Advanced Protection will be notified when the mode is enabled so they can ensure their app features adjust accordingly. For users, once Android 17 rolls out these features, there will be a notification if Advanced Protection is active. To use Intrusion Logging, users will need to enable it manually in Advanced Protection settings.
These changes emerge amid ongoing issues with malicious use of accessibility services. Malicious apps have been using social engineering to trick users into enabling these services, then exploiting them to bypass security controls, harvest sensitive data, or take over installed apps. Android has already adopted a number of countermeasures—blocking sideloaded apps from accessing accessibility services, protecting in-call states, implementing sensitive-data flags in UI views, and restricting accessibility API access under the existing Advanced Protection Mode.
With Android 17’s updates, the intent is to raise the bar even higher for device protection—especially for users who need maximum defense. The system now clamps down on attack surfaces, fortifies defenses against both software- and hardware-based threats, and gives users greater visibility into app permissions.
