Android 17 Advanced Protection Locks Accessibility Services to Verified Accessibility Tools
- ID
- 31062
- Status
- summarized
- Published
- 02 Oct 2026, 4:01 PM
- Fetched
- 02 Oct 2026, 5:26 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/10/android-17-advanced-protection-locks.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 6.5
- Created
- 02 Oct 2026, 5:27 PM
- Tags
- Audience
- developersvibe_coders
What happened
Google announced that Android 17, when Advanced Protection is enabled, will restrict AccessibilityService access exclusively to verified apps categorized as Accessibility Tools. The AccessibilityService API runs in the background, intercepts UI events and acts on other apps; Google says banking trojans and spyware have abused it to read sensitive data, draw fake login screens over legitimate apps, log keystrokes and initiate fraudulent transfers without root. The post also lists earlier countermeasures: blocking sideloaded apps from enabling accessibility services, in-call protections against disabling Play Protect or granting accessibility permissions, and the accessibilityDataSensitive flag developers can set on sensitive views or composables.
Why it matters
If your Android app uses AccessibilityService for anything other than assistive technology — automation, screen reading, UI scripting, task bots — it will stop working for any user with Advanced Protection on, so check whether your app can be verified and categorized as an Accessibility Tool before your next release. Separately, the accessibilityDataSensitive flag mentioned here is something you can set today on views/composables that show balances, OTPs or personal data, which is a concrete hardening step you can ship without waiting for Android 17.
Discussion angle
For builders who rely on AccessibilityService for legit non-assistive automation: is there a viable verification path as an 'Accessibility Tool', or should you be migrating to a different API now — and what breaks first for your users when Advanced Protection is on?