Affiliate links on Android Authority may earn us a commission. Learn more.
That security patch date on your Android phone is no longer the full story
Google has released new tools allowing Android apps to get a much more accurate picture of how secure your phone really is.
By
•
•
•
Rita El Khoury / Android Authority
Add Android Authority on Google:
Preferred SourceGoogle Discover
TL;DR
- Google’s new Security State libraries let apps check the security status of individual Android components instead of relying only on the overall security patch level.
- Apps can also check whether a security update is available and ready for installation, potentially prompting users before they perform sensitive tasks.
- A phone can now be recognized as protected even if its overall security patch date hasn’t changed, as long as it has received the specific security fix.
Until now, your Android phone’s security patch level and the date attached to it have served as an easy way for apps and businesses to check whether your phone is up to date. But it doesn’t always tell the complete story.
That’s because Android can update different parts of the OS separately. Some updates come directly from the phone maker, while other components can be updated through Google Play without requiring a full system update.
Google has now released the stable versions of its AndroidX Security State and Security State Provider libraries. These are essentially new tools that can give your phone’s apps a more detailed look at the security state of your device.
For example, an app can check which security fixes are already installed, what the latest available fixes are, and whether an update is waiting to be installed on your particular phone.
Hadlee Simons / Android Authority
An approach like this may be useful for apps where security is particularly important, like banking apps.
For example, a banking app could check whether your phone has a particular security fix before allowing you to perform a sensitive function. If an update is already available but hasn’t been installed, the app may be able to ask you to install it instead of simply not responding or saying that your phone isn’t up to date.
Google also says apps can check whether specific security vulnerabilities, known as CVEs, have been fixed on a device. For instance, apps will be able to verify that critical NFC or Bluetooth fixes are in place before authorizing tap-to-pay or proximity data sharing.
Meanwhile, phone makers will also be able to show that they’ve fixed specific security problems.
Sometimes a manufacturer can add a particular security fix to a phone without changing its overall security patch date. With Android 17, OEMs can tell Android about these individual fixes, and the new Security State tools can make that information available to apps.
So, for example, your phone might still show an older overall security patch date even though a particular security vulnerability has already been fixed.
Ultimately, this isn’t something regular Android users like you and me would immediately notice. Most of these changes will take place behind the scenes. However, over time, apps could get a much clearer picture of whether a phone is actually protected without relying on the security patch date alone.
News
AndroidAndroid SecurityGoogle
Follow
Thank you for being part of our community. Read our Comment Policy before posting.
