Android 17 Advanced Protection Limits Accessibility Services to Verified Tools

New Security Measure in Android 17

Google announced that Android 17 will implement a new security measure. When Advanced Protection is enabled, access to Android's accessibility services will be limited exclusively to applications verified and categorized as Accessibility Tools. This change is intended to mitigate a significant security vulnerability.

Addressing Malicious Exploitation

The Android AccessibilityService API, while designed for assistive technologies, has been widely abused by malicious Android applications. These applications exploit the API to facilitate malware distribution and financial fraud. By restricting access, Google aims to close this attack pathway, which has been used to extract sensitive data and perform unauthorized actions without requiring root access.

Impact of Accessibility Service Abuse

The AccessibilityService API allows applications to run in the background, intercept user interface events, and interact with other applications. Malicious actors have leveraged this privileged access to initiate fraudulent fund transfers, log keystrokes, overlay fake login screens, and grant themselves additional sensitive permissions after tricking users into enabling the service. This exploitation turns genuine assistive features into tools for cyberattacks.

Previous Security Efforts

Google has previously implemented several measures to counter the abuse of accessibility services. These include blocking sideloaded apps from enabling accessibility services, introducing in-call protections to prevent disabling Google Play Protect or granting accessibility permissions, and providing the accessibilityDataSensitive flag for developers to mark sensitive data. The new restriction in Android 17 builds on these prior efforts to enhance device security.