Android 17 Advanced Protection Adds Six Anti-Spyware Features

Google detailed six Android 17 Advanced Protection features on October 1, 2026, aimed at spyware, USB access, and accessibility abuse.

Google is adding six Advanced Protection capabilities in Android 17, detailed on October 1, 2026, for journalists, officials, and other high-risk users facing targeted spyware and physical access. Optional Intrusion Logging records security, app, and network events—including, by one account, process, install, DNS, IP, USB, and lock events—and keeps end-to-end encrypted copies on Google servers for a rolling 12 months. One source says the logs include Chrome Incognito site visits but not specific pages, while a later source says they can capture Incognito network events; Google says it cannot read the logs and neither side can delete them early, existing users must enable logging manually after notification, and one report says it needs separate consent. USB Protection blocks new USB data connections while a device is locked, while charging still works, on Pixel 6 and later and, according to one source, selected other Android 17 devices; Failed Authentication Lock covers repeated failures on selected devices, and one report says four features are general while USB protection and that lock are device-limited. Enabling the mode restricts AccessibilityService to verified assistive apps or Accessibility Tools, a path abused by banking trojans and spyware, and adds a page of apps that support, check, or honor the mode. Sources disagree on WebGPU: three say it is disabled in Chrome, while one says it can be disabled. Google cited no new campaign, victim totals, or CVE.

• On October 1, 2026, Google detailed six Android 17 Advanced Protection features for journalists, officials, and other high-risk users, describing them as an expansion of Android 16 protections and citing no new campaign, victim totals, or…
• Optional Intrusion Logging records security, app, and network events—one report lists process, install, DNS, IP, USB, and lock events—and stores end-to-end encrypted copies on Google servers for a rolling 12 months.
• One report says logging includes Chrome Incognito site visits but not specific pages; a later report says it can capture Incognito network events. Google says it cannot read the logs and neither side can delete them early.
• People already on Advanced Protection are notified and must turn Intrusion Logging on manually; one report says logging needs separate consent.
• USB Protection blocks new USB data connections while a phone is locked, while charging still works, on Pixel 6 and later and, according to one source, selected other Android 17 devices.
• Advanced Protection restricts AccessibilityService to verified assistive apps or Accessibility Tools, a path abused by banking trojans and spyware, and adds a page of apps that support, check, or honor the mode.
• Failed Authentication Lock reacts to repeated failed logins on selected devices; one source says four features are general while USB protection and this lock are device-limited.
• Three reports say Chrome WebGPU is disabled under Advanced Protection; one says WebGPU can be disabled.