Google has detailed a set of new protections for Android 17's Advanced Protection mode, including tamper-resistant forensic logging and tight limits on the accessibility features that Android malware commonly abuses, Help Net Security reported Friday. Advanced Protection is an opt-in setting for people at elevated risk of targeted attacks, such as journalists and activists.

What Happened

Il-Sung Lee, a group product manager for Android security, described the features in a post on Google's security blog. The most significant is Intrusion Logging, which records security events, network activity and app behavior, including activity in Chrome Incognito tabs. The logs are end-to-end encrypted and stored on Google's servers in a form Google says it cannot read.

The logs cover a rolling 12-month period and are deleted automatically when they age out. Neither the user nor Google can delete them before then, even if logging is switched off or the Google account is closed. Users can download and decrypt their logs and share them with security experts. The feature has to be turned on manually in Advanced Protection settings.

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says

Advanced Protection will also restrict the AccessibilityService API to verified apps that are classified as accessibility tools. Other additions include:

  • USB Protection, which blocks new USB data connections while the phone is locked, on Pixel 6 and later models and selected Android 17 devices.
  • Disabling WebGPU in Chrome to reduce exposure to browser exploits.
  • A Failed Authentication Lock that locks the device after repeated failed unlock attempts, to counter brute-force attacks.
  • A View Supporting Apps page listing installed apps that check whether Advanced Protection is on.

Developers can also be notified when a user turns on Advanced Protection so their apps can switch on matching safeguards.

Why It Matters

Spyware investigations often stall because sophisticated implants delete their traces, and a phone may hold little evidence by the time a researcher examines it. Storing a year of activity off the device, where neither an attacker on the phone nor the user can erase it, changes that. Donncha Ó Cearbhaill, head of Amnesty International's Security Lab, said it is the first time a consumer mobile platform has introduced purpose-built forensic logging for detecting targeted attacks, and called it "a potential game-changer for spyware accountability."

The accessibility change targets the most common way Android malware gains broad control. Once a user is tricked into granting accessibility access, a malicious app can log keystrokes, draw fake login screens over banking apps, grant itself further permissions and initiate fraudulent transfers, all without root access, The Hacker News reported. Limiting the API to verified accessibility tools removes that option for apps installed on protected devices.

Context

Google has narrowed accessibility access in steps. It previously blocked sideloaded apps from enabling accessibility services, added in-call protections against granting permissions during phone calls and introduced a flag that lets apps mark sensitive data so accessibility services cannot read it, according to The Hacker News. Advanced Protection first arrived as a single switch that turns on Google's strictest settings at once.

The trade-off is convenience. Advanced Protection already limits features such as app sideloading, and disabling WebGPU or blocking USB data while locked will be unnecessary friction for most users, which is why Google keeps the mode optional.

What to Watch

The features roll out with Android 17 on Pixel 6 and newer phones and selected other devices. Forensic groups such as Amnesty's Security Lab could soon begin using Intrusion Logging data in spyware cases, which will show how useful the logs are in practice. The coverage did not detail how Google will verify which apps qualify as accessibility tools, a process that will matter to legitimate developers of automation and assistive software.