Android apps can now check security patches down to individual device components
Google shipped stable AndroidX Security State libraries letting Android apps check per-component patch levels and CVE patch status via OSV data.
Security State v1.1.0 and Security State Provider v1.0.0 expose three patch levels per device component: installed (DSPL), published in Android Security Bulletins (PSPL), and available to download (ASPL), covering the OS, Play system modules, and the Linux kernel. Apps can verify specific CVE fixes, for example NFC or Bluetooth patches before enabling tap-to-pay, and the libraries integrate with the Open Source Vulnerabilities database for CVE-level auditing. Google Play system updates and GOTA already adopt the framework, and Android 17 lets manufacturers declare backported fixes beyond the stated patch level.
- DSPL, PSPL, and ASPL provide granular per-component patch visibility, including kernel versions
- Banking and enterprise apps can gate high-value actions on verified patch state
- OSV integration enables CVE-level auditing with device-specific vulnerability reports
- Vendors
From the original article
2 min read at helpnetsecurity.com
New AndroidX Security State libraries provide a more granular way to determine how securely patched an Android device is. The stable Security State v1. 1.
By Anamarija Pogorelec · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.