Google ships stable AndroidX Security State libraries so apps can verify per-component security patches

Google released stable AndroidX Security State 1.1.0 and Security State Provider 1.0.0, letting Android apps query device, published, and available patch levels for the OS, Mainline/Play system modules, and the Linux kernel, and audit CVE fixes via the Open…

Google shipped stable AndroidX Security State libraries (Security State v1.1.0 and Security State Provider v1.0.0) that give Android apps granular visibility into per-component patch posture. The libraries expose three patch levels per device component — installed (DSPL), published in Android Security Bulletins (PSPL), and available to download (ASPL) — covering the Android OS/system, Play system (Mainline) modules, and the Linux kernel. Apps can run vulnerability-specific checks, for example verifying NFC or Bluetooth fixes before enabling tap-to-pay, and the libraries integrate with the Android Security Bulletin data via the Open Source Vulnerabilities (OSV) database for CVE-level auditing with device-specific vulnerability reports. Google Play system updates and GOTA already adopt the framework. On Android 17, a new Supplemental Patches XML lets manufacturers declare OEM backported fixes beyond the stated patch level so they are recognized immediately. Intended use cases include banking, fintech, healthcare, and MDM/enterprise apps gating high-value actions on verified patch state and enforcing security baselines.

• Stable library versions: AndroidX Security State 1.1.0 and Security State Provider 1.0.0
• Three patch levels exposed per component: DSPL (installed), PSPL (published in Android Security Bulletins), and ASPL (available to download)
• Coverage spans the Android OS/system, Play system (Mainline) modules, and the Linux kernel (LTS kernels), including kernel versions
• Apps can perform CVE-specific checks on components such as NFC and Bluetooth, e.g. before enabling tap-to-pay
• Integration with the Open Source Vulnerabilities (OSV) database enables CVE-level auditing with device-specific vulnerability reports
• Google Play system updates and GOTA have already adopted the framework
• Android 17 adds Supplemental Patches XML so OEM backported fixes beyond the stated patch level are recognized immediately
• Targeted at banking, fintech, healthcare, and MDM apps enforcing security baselines; banking and enterprise apps can gate high-value actions on verified patch state