Android 17 Advanced Protection restricts accessibility services to verified apps

When Advanced Protection is on, Android 17 will limit the AccessibilityService API to verified Accessibility Tools apps, blocking a technique malware uses to read screens, steal data, and move money.

Google will restrict which applications can use Android's AccessibilityService API when Advanced Protection is enabled, starting with Android 17. The API will stay available only to apps Google verifies and categorizes as Accessibility Tools.

The AccessibilityService API lets an app run in the background, intercept interface events, and act for the user. Google built it to serve people with disabilities through screen readers and voice control. Banking trojans and spyware have exploited the same access for years.

A malicious app with accessibility privileges can log keystrokes, paint fake login screens over banking apps, trigger fraudulent transfers, and grant itself extra permissions. Root access is not required. The user only needs to get talked into enabling the service once.

"In Android 17, enabling Advanced Protection automatically restricts AccessibilityService access exclusively to verified applications categorized as Accessibility Tools, closing off a major avenue of attack while preserving vital assistive technology," Google said Thursday.

"Because accessibility services are designed to interact directly with the screen, malicious actors can exploit them to read sensitive data, install malware, or block uninstallation," the company added.

Google's earlier moves on the same surface

Google has tightened this API in several steps before the Android 17 change:

Sideloading is blocked from enabling accessibility services.

In-call protections stop users from disabling Google Play Protect, sideloading apps, or granting accessibility permissions while a call runs.

The accessibilityDataSensitive flag lets developers mark views and composables that hold sensitive data, keeping those views away from apps with malicious intent.

Android Advanced Protection Mode already limits which apps can call the accessibility API.

Android 17 goes further. With Advanced Protection on, the system checks an app's verification status before it can register an AccessibilityService at all.

What else ships with Android 17 protection

Accessibility restrictions arrive alongside other security changes in this release:

Intrusion Logging records persistent, privacy-preserving forensic data for investigating sophisticated spyware. Users switch it on manually from Advanced Protection settings.

USB Protection blocks unauthorized access through a physical USB connection.

WebGPU is disabled in this mode, cutting exposure to browser-based exploits.

Failed Authentication Lock shuts down the device after repeated failed unlock attempts, stopping brute-force attempts and physical tampering.

View Supporting Apps shows which installed apps have queried the Advanced Protection status.

What developers and users should do now

Users already on Advanced Protection will get a notification when the new controls reach their device. Turning on Intrusion Logging takes one visit to the Advanced Protection settings page.

Treat accessibility permission requests as risk signals. An app that does not need screen-reading or input-control features has no business asking for them. On Android 17 with Advanced Protection on, the system now denies that access to unverified apps by default.

Google laid out the Android 17 security details in its Android Developers blog and Advanced Protection documentation .

Source : thehackernews.com