Android Security Evolution

Significant security enhancements of recent major Android versions, starting with Android 5.0 Lollipop (API 21).

Android 5.0 (API 21) - Lollipop

Security Enhancements - Android 5

• Starting August 2023, Google Play Services updates will only be received from this Android version see Google Play services discontinuing updates for KitKat (API levels 19 & 20) starting August 2023
• Full Disk Encryption (FDE) by default (manufacturers can still opt out), see Encryption and Security Enhancements in Android 5.0
• SELinux fully enforced, see Security Enhancements in Android 5.0
• WebView is a separate package, see Security Enhancements in Android 5.0 and The Updatable WebView on Android 5.0 Lollipop What Is It and Why Should You Care?

Android 6 (API 23) - Marshmallow

Security Enhancements in Android 6

• Keystore API significantly extended (symmetric cryptographic primitives, AES and HMAC support and access control system for hardware-backed keys) see Hardware-backed Keystore
• TEE is a requirement, see Hardware-backed Keystore and 7.3.10. Fingerprint Sensor section of Android 6.0 Compatibility Definition
• New API (isInsideSecureHardware) for checking whether a KeyStore key is stored in secure hardware (e.g., Trusted Execution Environment (TEE) or Secure Element (SE)), see isInsideSecureHardware method of KeyInfo
• Apps need to request permissions at runtime see Runtime Permissions section of Android 6.0 Changes and Request runtime permissions and Security Enhancements in Android 6.0
• More restrictive SELinux (IOCTL filtering, tightening of SELinux domains, etc.) see Security-Enhanced Linux in Android and Security Enhancements in Android 6.0

Android 7 (API 24) - Nougat

Security Enhancements - Android 7

• Separate User and System Certificate Trust Store, meaning Man-in-the-Middle attacks basically require root access from this point, see Changes to Trusted Certificate Authorities in Android Nougat
• Added Network Security Config support so apps can customize the behavior of their secure (HTTPS, TLS) connections in a simple declarative way, without code modification. It supports custom trust anchors (which Certificate Authorities (CA) the app trusts), debug-only overrides, cleartext traffic opt-out and certificate pinning (limiting which server keys are trusted), see Network Security Config section of Android 7.0 for Developers
• By default apps targeting Android 7.0 only trust system-provided certificates and no longer trust user-added Certificate Authorities (CA), even without custom Network Security Config, see Default Trusted Certificate Authority of Android 7.0 for Developers
• Update to Keymaster 2 with support for Key Attestation and version binding (preventing rolling back to an unsecure old version without losing keys), see Key Attestation section of Android 7.0 for Developers and Keymaster Functions and Verifying hardware-backed key pairs with Key Attestation and Key and ID Attestation
• File Based Encryption (FBE) introduced, but it's optional to implement by manufacturers, see and and

Android 8 (API 26) - Oreo

Security Enhancements - Android 8

• JavaScript evaluation runs in a separate process in WebView so JavaScript code cannot access the app's memory so easily, see What’s new in WebView security and Security section of Android 8.0 Behavior Changes for All Apps
• WebView respects Network Security Config and cleartextTrafficPermitted flag (on older Android versions it loads HTTP sites even if clear text traffic should not be allowed by the config), see Security section of Android 8.0 Behavior Changes for Apps Targeting Android 8.0
• Safe Browsing API added to WebView so users would be warned when trying to navigating to a potentially unsafe website (verified by Google Safe Browsing) if enabled, see WebView APIs section of Android 8.0 Features and APIs
• FLAG_SECURE Window flag is supported more and disallows taking screenshots of the screen where this is set
• Update to Keymaster 3 with rewritten Hardware Abstraction Layers (HALs) written in and in C++ (as compared to that was written in C) with support, see and and

Android 9 (API 28) - Pie

Android 9 release notes - Security features

• Cleartext network traffic (HTTP) disabled by default, apps need to explicitly set cleartextTrafficPermitted to true in their Network Security Config it if they still want to use it (not recommended), see Network TLS enabled by default section of Behavior changes: apps targeting API level 28+ and Android: Cleartext HTTP traffic not permitted Android 9
• Update to Keymaster 4 with support for 3DES encryption and secure key import, see Hardware-backed Keystore and Keymaster Functions
• Replace many BouncyCastle implementations of cryptographic algorithms with Conscrypt ones, see Conscrypt implementations of parameters and algorithms section of Android 9 Behavior changes: all apps
• Added support for embedded Secure Element (SE), see Secure Element (SE) service section of Android 9 release notes and CTS test for Secure Element
• Disk Encryption (can be either Full Disk Encryption (FDE) or File Based Encryption (FBE)) is mandatory for all devices (shipping with this version)
• BiometricPrompt introduced standardizing the UI that is shown during biometric authentication and providing a better API to apps that is harder to misuse, the previous solution, gets , see

Android 10 (API 29) - Quince Tart

Security Enhancements - Android 10

Android 10 release notes - Security features

• File access disabled by default in WebView, see setAllowFileAccess method of WebSettings
• TLS 1.3 become available and enabled by default, see TLS 1.3 enabled by default section of Android 10 Behavior changes: all apps
• Certificates signed with SHA-1 no longer trusted in TLS
• Background apps cannot launch other Activities (e.g. other apps), see Background apps launching section of Android 10 release notes and Background activity restrictions section of Security and Privacy Enhancements in Android 10
• File Based Encryption (FBE) is mandatory for devices that launch with this Android version (devices updated to it can still continue using Full Disk Encryption (FDE)), see Encryption
• Only the default Input Method Editor (IME) app can access Clipboard data from the background, see Limited access to clipboard data section of Privacy changes in Android 10 and Clipboard data section of Security and Privacy Enhancements in Android 10
• StrandHogg 2.0 exploit (CVE-2020-0096) no longer possible (a patch for the vulnerability is also backported to , and with the - if the manufacturer released the update to a device), see and and

Android 11 (API 30) - Red Velvet Cake

Android 11 release notes - Secure

• Task Hijacking (StrandHogg 1.0) exploit (when another app sets its taskAffinity to the same as the target to trick the user to launch it even if they inteded to launch the target app and used it's legitimate app icon) no longer possible, see StrandHogg Attack / Task Affinity Vulnerability and Strandhogg Vulnerability
• Apps can no longer query information about other installed apps by default, see Package visibility filtering on Android and Package visibility in Android 11
• Runtime Permissions auto-reset for unused apps, see Auto-reset permissions from unused apps section of Permissions updates in Android 11 and Auto-reset permissions of unused apps section of Request runtime permissions
• Scoped Storage introduced, but apps can still opt-out of it via requestLegacyExternalStorage, see Storage updates in Android 11 and Opt out in your production app section of Android storage use cases and best practices
• Added standalone (not just as fallback) DEVICE_CREDENTIAL (PIN, pattern or password) authenticator to BiometricPrompt
• with custom views (set via ) can no longer be launched from the background. This is to mitigate certain attacks that relied on those obscuring the UI of a victim app. Mind you, the whole method is deprecated in Android 11 (API 30). See

Android 12 (API 31) - Snow Cone

Security Enhancements - Android 12

Android 12 release notes

• android:exported flag needs to be defined explicitly in Manifests for components (Activities, Content Providers, etc.) that declare Intent Filters, see Safer component exporting section of Behavior changes: Apps targeting Android 12
• Generic web Intents resolve to user's default browser app unless the target app is approved for the specific domain contained in that web Intent, see Web intent resolution section of Android 12 Behavior changes: all apps
• Replace more BouncyCastle implementations of cryptographic algorithms with Conscrypt ones, see BouncyCastle implementation removed section of Android 12 Behavior changes: all apps
• The user gets notified if an app accesses Clipboard data of another app for the first time, see System notification shown when your app accesses clipboard data section of Copy and paste
• Apps can no longer close System Dialogs, see Apps can't close system dialogs section of Android 12 Behavior changes: all apps
• Tapjacking mitigation: Apps are prevented from consuming touch events where an overlay obscures the app, see Cloak & Dagger
• Scoped Storage always enforced, opting out of it via requestLegacyExternalStorage is no longer possible, see Opt out in your production app section of Android storage use cases and best practices

Android 13 (API 33) - Tiramisu

Security Enhancements - Android 13

Android 13 release notes - Security

• Non-matching Intents are blocked by Intent filters (apps cannot send an Intent to another app's exported component unless it fully matches the Intent filter defined by it), see Intents should match declared intent filters section of Android 13 and Android 13 QPR release notes
• Only File Based Encryption (FBE) is allowed, Full Disk Encryption (FDE) is no longer - not even for devices updated from a version that it was allowed
• Shared UIDs are deprecated. It was used to share the sandbox access between two or more apps and the ability to run in the same process. It could cause non-deterministic behavior within the package manager so it would be removed in a future Android version. See Application Signing
• Keymaster support for symmetric cryptographic primitives such as AES (Advanced Encryption Standard), HMAC (Keyed-Hash Message Authentication Code), and asymmetric cryptographic algorithms (including Elliptic Curve, RSA2048, RSA4096, and Curve 25519)
• POST_NOTIFICATIONS runtime permission added for sending non-exempt (including Foreground Services (FGS)) notifications from an app, see Notification runtime permission and android.permission.POST_NOTIFICATIONS
• Apps need the runtime permission to show Toasts when not in foreground. This can be very counter-intuitive to describe to users why the app needs permission to post notifications if they only want to show you Toast messages, furthermore Toasts cannot be associated with notification channels. See

Android 14 (API 34) - Upside Down Cake

Security Enhancements - Android 14

Android 14 Security Release Notes

• Introducing minimum targetSdk requirement: apps that target Android versions older than Android 6 (API 23) can no longer be installed. This means that you can assume that the security restrictions (noteworthily Runtime Permission handling in this case) introduced with Android 6 (API 23) now applies to all apps installed on the device (this minimum is expected to increase with each future Android versions), see Minimum installable target API level section of Behavior changes: all apps
• The app's name, that stored a particular media file is redacted by default (unless it's package name is always visible to other apps or the app that queries it has the QUERY_ALL_PACKAGES permission granted - which requires special manual Google Play review to attain), see Media owner package names might be redacted section of Behavior changes: all apps
• Add some description to location permission prompts that describe why an app might need this permission.
• Significant improvements to Hardware-assisted AddressSanitizer (HWASan), which was introduced back in Android 10 as a memory error detection tool similar to the deprecated AddressSanitizer which it replaces.
• Added support to reject null-ciphered cellular connections, ensuring that circuit-switched voice and SMS traffic is always encrypted and protected from passive over-the-air interception, see Android 14 introduces first-of-its-kind cellular connectivity security features
• Added support for multiple IMEIs
• AES-HCTR2 is now the preferred mode of filenames encryption for devices with accelerated cryptography instructions.

Android 15 (API 35) - Vanilla Ice Cream

Android 15 Security Release Notes

• Apps that target Android versions older than Android 7 (API 24) can no longer be installed. This means that you can assume that security restrictions introduced with Android 7 (API 24) now applies to all apps installed on the device, see Increased minimum target SDK version from 23 to 24 section of Behavior changes: all apps
• The system now asks for biometrics (if they are enrolled) when changing USB mode and screen timeout, see Android 15 will verify it's you when you connect to a PC
• Further mitigation for task hijacking (StrandHogg): if the top activity finishes a task, Android will go back to whichever task was last active. Moreover, if a non-top activity finishes its task, Android will go back to the home screen; it won't block the finish of this non-top activity, see Other changes section of Behavior changes: Apps targeting Android 15 or higher
• Further mitigation for task hijacking (StrandHogg): Arbitrary activities can no longer be launched from other apps into your own task, see Other changes section of Behavior changes: Apps targeting Android 15 or higher
• Mitigation for attackers abusing misconfigured PendingIntents: PendingIntent creators now block background Activity launches by default if your app targets Android 15 (API 35), see Other changes section of Behavior changes: Apps targeting Android 15 or higher
• By default, apps are no longer allowed to bring the task stack to the foreground unless the PendingIntent creator allows background activity launch privileges or the sender has background activity launch privileges, if your app targets Android 15 (API 35), see Other changes section of Behavior changes: Apps targeting Android 15 or higher

Android 16 (API 36) - Baklava

Android 16 Security Release Notes

• Added default security against general Intent redirection attacks, blocking launching Intents received from other apps, e.g. wrapped as an extra to the Intent that launches the current app, see Improved security against Intent redirection attacks section of Behavior changes: all apps
• New protection for user's location privacy from malicious apps, during companion device pairing flow. All companion apps running on Android 16 are no longer directly notified of discovery timeout using RESULT_DISCOVERY_TIMEOUT. Instead, the user is notified of timeout events with a visual dialog. When the user dismisses the dialog, the app is alerted of the association failure with RESULT_USER_REJECTED, see Companion apps no longer notified of discovery timeouts section of Behavior changes: all apps
• MediaStore#getVersion() will now be unique to each app. This eliminates identifying properties from the version string to prevent abuse and usage for fingerprinting techniques, see MediaStore version lockdown section of Behavior changes: Apps targeting Android 16 or higher and getVersion method of MediaStore
• Apps can opt-in to strict intent resolution using their app manifest. Safer Intents (originally introduced in Android 15 part of StrictMode) means that Intents must have non-null action and match the Intent filter of the target app to be delivered. Either both of these rules, or only Intent Filter matching can now be enforced, see Safer Intents section of Behavior changes: Apps targeting Android 16 or higher and more specifically the

Android 17 (API 37) - Cinnamon Bun

Android 17 Security Release Notes

• Introduce Android Contact Picker, a standardized, browsable interface for users to share contacts with your app, without the need ro READ_CONTATCS permission, see Android contacts picker section of Features and APIs
• No longer permit cross-profile loopback traffic, see Block cross profile loopback traffic section of Behavior changes: all apps
• Enforce a limit (50,000 keys for non-system apps targeting Android 17) on the number of keys an app can create in Android Keystore to protect this shared resource as this storage is limited and shared between apps. If an app attempts to create keys beyond the limit, the creation fails with a KeyStoreException, see Per-app keystore limits section of Behavior changes: all apps
• New detection capabilities for StrictMode (this will be enforced in Android 18 by default): Currently, if an app launches an intent with a URI that has the action ACTION_SEND, ACTION_SEND_MULTIPLE, or ACTION_IMAGE_CAPTURE, the system automatically grants the read and write URI permissions to the target app. Starting in Android 18, the system will no longer automatically grant these permissions, see Restrict implicit URI grants section of Behavior changes: all apps
• Enable Certificate Transparency by default for apps targeting Android 17 or higher see Enable CT by default section of Behavior changes: Apps targeting Android 17 or higher