Google Android 17 Gets 6 Advanced Protection Features

Key Takeaways

• Google has rolled out six new Advanced Protection features for Android 17, designed to combat sophisticated cyberattacks, scams, and unauthorized access attempts.
• These enhancements include stronger restrictions on accessibility permissions and USB connections, a reduced browser attack surface, and a new intrusion logging feature for forensic investigations.
• The new protections are primarily aimed at high-risk individuals such as journalists, public figures, and elected officials, but some features are available more broadly.
• While four features are generally available on Android 17, USB Protection and Failed Authentication Lock are limited to specific devices, including Pixel 6 and newer.
• Users must manually enable “Intrusion Logging” even after activating Advanced Protection to utilize its forensic benefits.

Android 17 Fortified with Six Advanced Protection Features

Google has unveiled six significant enhancements to its Advanced Protection Program for Android 17, specifically engineered to defend against advanced persistent threats, intricate scams, and illicit device access. These updates, announced on October 1, 2026, integrate more stringent security protocols with critical tools for evidence preservation, offering users a robust defense in the event of a suspected compromise.

These new features build upon the security foundation established with Android 16, rather than addressing a newly identified widespread malware campaign. The initiative aims to consolidate security controls for individuals at heightened risk, including journalists, government officials, and prominent public figures, providing them with a more comprehensive defense posture.

Google Security highlighted that malicious applications frequently exploit accessibility permissions to exfiltrate sensitive data, install malware, or resist uninstallation. As Google said in a report, these new enhancements directly counter such threats, alongside mitigating browser exploits and attempts at physical tampering.

The Advanced Protection Program centralizes security settings across core Google applications like Chrome, Google Messages, and Phone by Google, all controlled by a single toggle. It also prevents the deactivation of fundamental security measures such as Google Play Protect and Scam Detection. Google’s announcement did not disclose any specific victim counts or details of particular attack campaigns driving these updates.

Detailed Overview of New Security Features

The six newly introduced features span various stages of a potential security incident, from preemptive access restrictions to post-compromise forensic data collection. Google states that four of these features are universally available on Android 17 devices, while “USB Protection” and “Failed Authentication Lock” are restricted to select hardware.

Enhanced Protection Capabilities

• Intrusion Logging: This feature securely stores critical security and network events in end-to-end encrypted cloud storage. Records are maintained for a rolling 12-month period before automatic deletion, providing an immutable log for investigations. Users must manually opt-in to activate this logging, and only they can access their records.
• USB Protection: When a device is locked, new USB connections are automatically restricted to charging-only mode. Existing connections established before the device was locked remain active. This measure prevents unauthorized physical data access via peripheral devices or public charging stations. It is available on Pixel 6 and newer devices, as well as specific Android 17 models.
• Accessibility Protection: This safeguard limits access to AccessibilityService permissions exclusively to verified applications categorized as legitimate Accessibility Tools when Advanced Protection is enabled. This closes a common attack vector exploited for fraud, data theft, and malware deployment, while ensuring essential assistive technologies remain functional.
• Disable WebGPU: Activating Advanced Protection now disables WebGPU in Chrome, curtailing access to advanced hardware-accelerated graphics functionalities. This action reduces the browser’s attack surface, minimizing exposure to sophisticated exploits targeting complex web graphics technologies.
• Failed Authentication Lock: This feature completely locks down the device following multiple unsuccessful authentication attempts within system settings or secured applications. It serves to deter further probing during physical tampering or brute-force authentication efforts. This functionality is exclusive to selected Android 17 devices.
• View Supporting Apps: A new settings page has been added to display applications that integrate with and check the status of Advanced Protection. This helps users understand which apps are leveraging the enhanced security framework, and allows developers to receive status notifications to automatically enable additional security or privacy features within their applications.

The restrictions on accessibility permissions directly address tactics observed in “fake streaming app” attacks, where users were tricked into granting broad accessibility access, allowing attackers to monitor screens and control devices remotely. While these new controls significantly bolster defenses, Google acknowledges they do not eliminate every potential infection vector.

Disabling WebGPU also mitigates risks associated with a component that has been implicated in actively exploited Chrome vulnerabilities. This change, while not a standalone patch for a specific vulnerability, proactively reduces the functional footprint of a potentially exploitable component.

Evidence Preservation and User Empowerment

The “Intrusion Logging” feature is a significant step towards addressing the challenges of investigating mobile compromises, particularly when attackers endeavor to erase local forensic traces. Organizations like Amnesty International and Reporters Without Borders have previously emphasized the critical utility of encrypted, remotely stored records for investigating suspected spyware attacks, especially those targeting journalists and other vulnerable individuals, as detailed in a report.

Existing users of the Advanced Protection Program should anticipate a notification when these new capabilities become available on their devices. It is crucial to note that while enabling the broader Advanced Protection mode activates many safeguards, users must navigate to the Advanced Protection settings and manually enable “Intrusion Logging” to benefit from its forensic capabilities.

Hardware compatibility also plays a role in the availability and behavior of certain features. Google advises that “USB Protection” may influence device functionality, including charging speeds, when the device is locked. Users are encouraged to differentiate between protections activated by the main Advanced Protection switch and optional, device-specific features to understand the full scope of safeguards available on their individual phones.

What You Should Do

• Enable Advanced Protection: If you are a high-risk individual (journalist, public figure, etc.), activate Google’s Advanced Protection Program through your Google Account settings.
• Manually Enable Intrusion Logging: After enabling Advanced Protection, go to its specific settings and manually opt-in for “Intrusion Logging” to ensure security and network events are recorded for potential forensic analysis.
• Update to Android 17: Ensure your device is updated to Android 17 to gain access to the latest security enhancements.
• Be Aware of Device Compatibility: Understand that features like “USB Protection” and “Failed Authentication Lock” may be limited to specific Android 17 devices (e.g., Pixel 6 and newer).
• Exercise Caution with Accessibility Permissions: Be extremely wary of applications requesting AccessibilityService permissions, especially if they are not legitimate assistive tools. Only grant these permissions to trusted applications.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.