Android apps can now check security patches down to individual device components
Google shipped stable AndroidX Security State libraries letting Android apps check per-component patch levels and CVE patch status via OSV data.
Security State v1.1.0 and Security State Provider v1.0.0 expose three patch levels per device component: installed (DSPL), published in Android Security Bulletins (PSPL), and available to download (ASPL), covering the OS, Play system modules, and the Linux kernel. Apps can verify specific CVE fixes, for example NFC or Bluetooth patches before enabling tap-to-pay, and the libraries integrate with the Open Source Vulnerabilities database for CVE-level auditing. Google Play system updates and GOTA already adopt the framework, and Android 17 lets manufacturers declare backported fixes beyond the stated patch level.