Advanced Protection (Product): news timeline & CVEs

Android 17 Advanced Protection Adds Intrusion Logging, USB Security and Brute-Force Defense

Google adds intrusion logging, USB lockdown, and brute-force defense to Android 17 Advanced Protection.

Google announced six Android 17 Advanced Protection enhancements on October 1, 2026, for journalists, officials, and other high-risk users. Optional Intrusion Logging records process, install, DNS, IP, USB, and lock events, encrypts them, and keeps them on Google servers for 12 months. USB Protection blocks new USB data connections while a supported device is locked, and Failed Authentication Lock reacts to repeated failed logins. The mode also restricts AccessibilityService to verified tools and disables Chrome WebGPU.

GBHackersOct 6, 10:30 UTC · 2d agoTools 4 sources1

Android 17 Advanced Protection Locks Accessibility Services to Verified Accessibility Tools

Android 17 Advanced Protection will limit AccessibilityService access to verified Accessibility Tools, blocking a common malware path.

Google said Android 17 will automatically restrict the AccessibilityService API to verified apps categorized as Accessibility Tools when Advanced Protection is enabled. The change targets a long-used path in which users are socially engineered into granting accessibility access so malware can read screens, log keystrokes, overlay fake logins, and initiate fraudulent transfers without root. Android 17 also adds privacy-preserving intrusion logging, USB connection protections, an option to disable WebGPU, a failed-authentication lock against physical tampering, and a view of apps that checked Advanced Protection status. Users already on Advanced Protection will be notified and must manually enable Intrusion Logging.

The Hacker Newsupdated Oct 6, 10:30 UTC · 2d agofirst Oct 2, 08:01 UTC · 6d agoAdvisory 4 sources1

Android 17 makes it harder for spyware to cover its tracks

Android 17 Advanced Protection adds off-device forensic logs and tighter controls against spyware and physical access.

Google is adding six Advanced Protection capabilities in Android 17 aimed at targeted spyware and physical access. Optional Intrusion Logging records security, app, and network events, including Chrome Incognito site visits but not specific pages, and stores end-to-end encrypted copies on Google servers for a rolling 12 months. USB Protection blocks new USB data connections while a phone is locked on Pixel 6 and later and selected Android 17 devices, while charging still works. Enabling Advanced Protection also restricts AccessibilityService to verified assistive apps, disables WebGPU in Chrome, includes Failed Authentication Lock on selected devices, and adds a View Supporting Apps settings page.

Help Net Securityupdated Oct 6, 10:30 UTC · 2d agofirst Oct 2, 05:30 UTC · 6d agoTools 4 sources

Advanced Protection

Timeline3 articles

Appears with

Android 17 Advanced Protection Adds Intrusion Logging, USB Security and Brute-Force Defense

Android 17 Advanced Protection Locks Accessibility Services to Verified Accessibility Tools

Android 17 makes it harder for spyware to cover its tracks