Google Adds 6 Advanced Protection Features to Android 17 Against Sophisticated Attacks

Google has detailed six Advanced Protection enhancements for Android 17, targeting sophisticated attacks, scams and unauthorized access.

Announced on October 1, 2026, the changes combine stronger restrictions with tools that preserve evidence when someone suspects their phone has been compromised.

The update expands protections introduced with Android 16 rather than announcing a newly discovered malware campaign.

Building on Android 16 security protections, the approach brings security controls together for journalists, elected officials, public figures and other users facing elevated risks.

Google Security noted that malicious applications abuse accessibility permissions to read sensitive information, install malware or prevent removal.

Google said in a report shared publicly and reviewed by Cyber Security News (CSN) that the enhancements address these threats alongside browser exploits and physical tampering.

Advanced Protection uses one switch to strengthen settings across Chrome, Google Messages and Phone by Google.

It also prevents foundational protections, including Google Play Protect and Scam Detection, from being disabled. The announcement provides no victim totals or evidence of a specific attack campaign.

Google Adds 6 Advanced Protection Features

The six features cover different stages of a potential compromise, from restricting risky access to preserving investigation records.

Google says four are available on Android 17 devices generally, while USB Protection and Failed Authentication Lock are limited to selected devices.

Feature	How it works	Security purpose and limitations
Intrusion Logging	Stores security and network events in cloud storage using end-to-end encryption. Records remain available for a rolling 12 months before automatic deletion.	Preserves tamper-resistant evidence for investigations. Only the user can access the logs, and recording requires a separate manual opt-in.
USB Protection	Makes new USB connections charging-only while the device is locked. Connections established before locking remain active.	Restricts unauthorized physical data access through accessories or charging stations. Available on Pixel 6 and newer devices and selected Android 17 devices.
Accessibility Protection	Restricts AccessibilityService access to verified applications categorized as Accessibility Tools when Advanced Protection is enabled.	Blocks a permission pathway used for fraud, sensitive-data theft and malware installation, while preserving access for legitimate assistive applications.
Disable WebGPU	Disables WebGPU in Chrome under Advanced Protection, reducing access to advanced hardware-accelerated graphics functionality.	Reduces the browser’s attack surface and exposure to sophisticated exploits involving complex web graphics technologies.
Failed Authentication Lock	Completely locks down the device after repeated authentication failures within settings or secured applications.	Limits further probing during physical tampering or repeated authentication attempts. Availability is restricted to selected Android 17 devices.
View Supporting Apps	Adds a settings page showing installed applications that check whether Advanced Protection is enabled.	Helps users understand participating apps. Developers can receive status notifications and automatically enable additional security or privacy features.

The permission restrictions address behavior seen in fake streaming app attacks, where users were persuaded to grant accessibility access before attackers watched screens and controlled devices. Google does not claim the new controls eliminate every possible infection route.

Disabling WebGPU also narrows exposure to a component implicated in actively exploited Chrome vulnerabilities, although the Android announcement does not identify a particular vulnerability as its trigger. The change reduces available functionality rather than describing a standalone patch.

Evidence Preservation And User Controls

Intrusion Logging helps address the difficulty of investigating mobile compromise after attackers erase local traces. Amnesty International and Reporters Without Borders described encrypted, remotely stored records as useful evidence for suspected spyware attacks, particularly against journalists and other vulnerable individuals.

Google recommends that existing Advanced Protection users watch for a notification when the capabilities reach their devices.

Anyone seeking the forensic benefits must open Advanced Protection settings and manually enable Intrusion Logging; activating the broader mode does not automatically start recording.

Hardware differences also matter. Google cautions that USB Protection may affect functionality, including charging speeds, while a device is locked.

Users should distinguish protections enabled through the main switch from optional logging and device-dependent features when reviewing what their phone actually supports. These differences determine which safeguards are available.

Stops threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC