Google's New Android Libraries Let Apps Check Individual Security Fixes, Not Just the Patch Date

Until now, the security patch level and the date attached to it have been the simple way for apps and businesses to judge whether a phone was up to date. That date does not always tell the complete story, because Android can update different parts of the operating system separately. Some updates come directly from the phone maker, while other components can be updated through Google Play without requiring a full system update.

With the new libraries, an app can check which security fixes are already installed, what the latest available fixes are, and whether an update is waiting to be installed on that particular phone.

Google points to apps where security matters most, such as banking apps. A banking app could check whether a phone has a particular security fix before allowing a user to perform a sensitive function. If an update is already available but has not been installed, the app may be able to ask the user to install it, instead of simply refusing to respond or reporting that the phone is not up to date.

Google also says apps can check whether specific security vulnerabilities, known as CVEs, have been fixed on a device. For instance, an app will be able to verify that critical NFC or Bluetooth fixes are in place before authorizing tap-to-pay or proximity data sharing.

Phone makers will likewise be able to show that they have fixed specific security problems. Sometimes a manufacturer adds a particular security fix to a phone without changing its overall security patch date. With Android 17, OEMs can tell Android about these individual fixes, and the new Security State tools can make that information available to apps. A phone might therefore still display an older overall security patch date even though a particular security vulnerability has already been fixed.

According to Android Authority, a phone can now be recognized as protected even if its overall security patch date has not changed, as long as it has received the specific security fix in question.

The changes are unlikely to be noticed immediately by regular Android users. Most of them will take place behind the scenes. Over time, however, apps could get a much clearer picture of whether a phone is actually protected without depending on the security patch date alone.