Google has added six new safeguards to Android 17's Advanced Protection mode, tightening the security tier built for people who face an outsized risk of targeted compromise — journalists, elected officials, executives and other high-profile users.
What happened
The update, rolled out from October 1, 2026, builds on the protections Android 16 introduced rather than responding to a newly discovered malware campaign. It brings together six controls that cover different stages of a potential device compromise, from blocking risky access in the first place to preserving evidence after the fact:
- Intrusion Logging — security and network events are stored in the cloud with end-to-end encryption and kept for a rolling 12 months. Recording only starts after the user manually opts in from the Advanced Protection settings menu.
- USB Protection — new USB connections default to charging-only while the device is locked, cutting off a common path for physical data theft via malicious cables or charging stations. Available on Pixel 6 and newer, plus select Android 17 devices.
- Accessibility Protection — restricts the Accessibility Service to apps Google has verified as genuine accessibility tools, closing a pathway attackers have used to watch screens and control devices after tricking users into granting the permission.
- Disable WebGPU — turns off Chrome's WebGPU support, shrinking the browser's exposure to a complex, hardware-accelerated graphics component.
- Failed Authentication Lock — locks the device entirely after repeated failed unlock attempts in settings or secured apps, limiting what an attacker can probe during physical tampering. Limited to select Android 17 devices.
- View Supporting Apps — a new settings page showing which installed apps actively check and respond to Advanced Protection status.
Four of the six are available broadly on Android 17; USB Protection and Failed Authentication Lock depend on device hardware.
Why it matters
The Accessibility Protection change directly answers a pattern security researchers have flagged repeatedly: fake streaming or utility apps that talk victims into granting accessibility access, then use it to watch the screen and operate the device remotely. Google isn't claiming the new controls close every infection route — but narrowing that one pathway, plus disabling WebGPU (a component that has featured in actively exploited Chrome bugs), removes two avenues attackers have relied on.
Intrusion Logging addresses a separate, harder problem: investigating a suspected compromise after an attacker has already wiped local traces. Rights groups including Amnesty International and Reporters Without Borders have pointed to encrypted, remotely stored activity logs as valuable evidence when journalists and activists suspect spyware — evidence that's much harder to recover once a device has been tampered with locally.
What to do
- If you're in a high-risk role, turn on Advanced Protection and separately enable Intrusion Logging — the two are not the same switch, and logging won't start automatically.
- Watch for Google's in-app notification confirming when these capabilities land on your device, since rollout is staged.
- If you rely on accessibility features for legitimate assistive tools, check that those apps are flagged as verified — Advanced Protection will otherwise restrict them.
- Be aware that USB Protection can affect charging speed while your device is locked; that's expected, not a malfunction.
- Don't treat any single control as complete coverage — these features reduce specific attack paths, they don't guarantee immunity from targeted compromise.