Enhancing Android Security Stop Malware From Snooping On Your App Data

We’ve seen that bad actors sometimes try to exploit accessibility API features to read sensitive information, like passwords and financial details, directly from the screen and manipulate a user's device by injecting touches. To combat this, Android 16 provides a new, powerful defense in a single line of code : accessibilityDataSensitive .

The accessibilityDataSensitive flag allows you to explicitly mark a view or composable as containing sensitive data. When you set this flag to true on your app, you are essentially blocking potentially malicious apps from accessing your sensitive view data or performing interactions on it. Here is how it works: any app requesting accessibility permission that hasn't explicitly declared itself as a legitimate accessibility tool ( isAccessibilityTool=true ) is denied access to that view.

This simple but effective change helps to prevent malware from stealing information and performing unauthorized actions, all without impacting users’ experience of legitimate accessibility tools. Note: If an app is not an accessibility tool but requests accessibility permissions and sets isAccessibilityTool=true , Play will reject it and Google Play Protect will block it on user devices.

Automatic, enhanced security for setFilterTouchesWhenObscured protection

We’ve already integrated this new accessibilityDataSensitive security functionality with the existing setFilterTouchesWhenObscured method.

If you already use setFilterTouchesWhenObscured(true) to protect your app from tapjacking, your views are automatically treated as sensitive data for accessibility. By enhancing the setFilterTouchesWhenObscured method with accessibilityDataSensitive protections, we’re instantly giving everyone an additional layer of defense with no extra work.

We recommend that you use setFilterTouchesWhenObscured , or alternatively the accessibilityDataSensitive flag, on any screen that contains sensitive information, including login pages, payment flows, and any view displaying personal or financial data.

Use the semantics modifier to apply the sensitiveData property to a composable.

In your XML layout, add the relevant attribute to the sensitive view.

Alternatively, you can set the property programmatically in Java or Kotlin:

myView.filterTouchesWhenObscured = true;

myView.isAccessibilityDataSensitive = true;

myView.setFilterTouchesWhenObscured(true)

myView.setAccessibilityDataSensitive(true);

Partnering with developers to keep users safe

We worked with developers early to ensure this feature meets real-world needs and integrates smoothly into your workflow.

"We've always prioritized protecting our customers' sensitive financial data, which required us to build our own protection layer against accessibility-based malware. Revolut strongly supports the introduction of this new, official Android API, as it allows us to gradually move away from our custom code in favor of a robust, single-line platform defense." - Vladimir Kozhevnikov, Android Engineer at Revolut

You can play a crucial role in protecting your users from malicious accessibility-based attacks by adopting these features. We encourage all developers to integrate these features into their apps to help keep users safe.

Together, we can build a more secure and trustworthy experience for everyone.

Bennet Manuel Group Product Manager read_more View profile

Robert Clifford Developer Relations Engineer read_more View profile

Boosting user privacy and business protection with updated Play policies arrow_forward Making Google Play the safest and most trusted experience possible. Today, we’re announcing a new set of policy updates and an account transfer feature to boost user privacy and protect your business from fraud. Bennet Manuel • 3 min read

Boosting user privacy and business protection with updated Play policies

Making Google Play the safest and most trusted experience possible. Today, we’re announcing a new set of policy updates and an account transfer feature to boost user privacy and protect your business from fraud.

Redefining Location Privacy: New Tools and Improvements for Android 17 arrow_forward A pillar of the Android ecosystem is our shared commitment to user trust. As the mobile landscape has evolved, so does our approach to protecting sensitive information. Robert Clifford • 3 min read #Android 17

Redefining Location Privacy: New Tools and Improvements for Android 17

A pillar of the Android ecosystem is our shared commitment to user trust. As the mobile landscape has evolved, so does our approach to protecting sensitive information.

Driving growth on Google Play: The era of subscriptions arrow_forward On Google Play, we are continuously expanding our subscription platform to help you drive growth, adapt to new business models, and meet your users exactly where they are. Sheenam Mittal • 4 min read #Google Play subscriptions

Driving growth on Google Play: The era of subscriptions

On Google Play, we are continuously expanding our subscription platform to help you drive growth, adapt to new business models, and meet your users exactly where they are.

#Google Play subscriptions