Android 17 Locks Accessibility Services to Verified Tools Under Advanced Protection

Google has announced a new security measure in Android 17: when Advanced Protection is enabled, access to accessibility services will be limited exclusively to verified applications classified as Accessibility Tools. The company calls this API a main conduit for malware and financial fraud and says the restriction closes off a major attack pathway while preserving genuine assistive technology.

Why accessibility

The AccessibilityService API is a powerful framework that lets an app run in the background, intercept UI events, and act on the user's behalf inside other applications. It was built to help people with disabilities — think screen readers and voice-control systems. But its privileged access has long been a favourite of banking trojans and spyware, which use it to siphon sensitive data and perform malicious actions without ever needing root.

All it takes is tricking a user into enabling the service under some plausible pretext, and the malware turns assistive features into weapons. It can programmatically initiate fraudulent transfers from financial apps, log keystrokes, draw fake login screens over legitimate ones, and grant itself extra sensitive permissions. According to Google, through such services attackers read data, install malware, and block their own uninstallation.

One step among many

Google has been fighting this for years: blocking sideloaded apps from enabling accessibility services; in-call protections that stop users from disabling Play Protect or granting permissions; the accessibilityDataSensitive flag that marks sensitive views; and Advanced Protection itself, which already restricted some apps from the API.

What else is new in Android 17

Beyond accessibility protection, Android 17 brings several other improvements. Intrusion Logging keeps a persistent, privacy-preserving forensic log to investigate sophisticated spyware attacks. USB Protection blocks unauthorized access over a physical connection. Disabling WebGPU reduces exposure to browser-based exploits. Failed Authentication Lock fully locks down the device against brute-force and physical tampering. And View Supporting Apps lets users see which installed apps have checked the Advanced Protection status.

Developers will be notified when the mode is enabled so they can pre-activate relevant features. Those already using Advanced Protection will get a notification as the new capabilities arrive; Intrusion Logging must be turned on manually in settings.

Source: The Hacker News