Android apps can now check security patches down to individual device components

New AndroidX Security State libraries provide a more granular way to determine how securely patched an Android device is. The stable Security State v1.1.0 and Security State Provider v1.0.0 libraries allow developers to check the security status of individual device components and determine whether security updates are ready to be downloaded and installed on a specific device.

For phone manufacturers and developers who build over-the-air (OTA) update systems, the androidx.security.state.provider library provides a standard way to let apps know when an update is available for a device.

Three levels of security patch information

“As Android has evolved to deliver rapid, independent component updates through modular systems like Google Play system updates, relying on a single SPL build property is no longer the best way to determine a device’s true security posture,” Google engineers explained.

Instead, the Security State libraries let developers check three patch levels for individual parts of a device.

The Device Security Patch Level (DSPL) shows what is currently installed and running on the device. The Published Security Patch Level (PSPL) shows the latest patches the company has officially published in the Android Security Bulletin, while the Available Security Patch Level (ASPL) shows what is available for that particular device to download and install.

Source: Google

The checks cover the core Android operating system, system modules updated through Google Play system updates, and the Linux kernel. Kernel security levels use version numbers, such as 5.15.159 or 6.1.91, instead of monthly security patch dates.

CVE-level security checks

This more detailed information can help security-sensitive apps decide whether to allow certain actions. For example, banking or enterprise apps could check installed patches and available updates before allowing high-value payments or credential enrollment.

Developers can also check whether specific high-risk vulnerabilities, tracked as CVEs, have been patched. Google said this could be used to verify that critical NFC or Bluetooth fixes are installed before enabling features such as tap-to-pay or proximity-based data sharing.

The libraries integrate with the Open Source Vulnerabilities (OSV) database to obtain Android Security Bulletin data and can download device-specific vulnerability reports for CVE-level auditing, providing a more detailed view of a device’s security state.

Android 17 also allows manufacturers to declare individual security fixes applied beyond a device’s stated security patch level, including fixes backported to older software.

Google Play system updates already provide ASPL information on Android devices with Google Mobile Services (GMS), while Google Over-The-Air (GOTA) has also adopted the framework. The company said it is working with device manufacturers to bring their OTA update clients to the standardized system.