Google has introduced a suite of six new security features within its Advanced Protection program for Android 17, designed to enhance user defenses against sophisticated attacks, particularly from spyware. A key addition is a forensic logging capability that stores tamper-resistant, encrypted security and network event logs off-device, making it harder for attackers to erase their tracks.
This new Intrusion Logging feature records app activity and network events, including activity within Chrome’s Incognito tabs, though it does not log specific pages visited. These end-to-end encrypted logs are stored on Google’s servers for a rolling 12-month period and cannot be manually deleted by either users or Google before their expiration, even if logging is disabled or an account is closed. Users can download and decrypt these logs to share with security experts for investigation. This optional feature requires a separate manual opt-in through the Advanced Protection settings. Google states it collaborated with civil liberties and press freedom organizations in developing this capability, which is described as a significant step for spyware accountability.
Beyond logging, Android 17’s Advanced Protection includes several device and browser protections. USB Protection, available on Pixel 6 and later models and select Android 17 devices, automatically blocks new USB data connections when the phone is locked. This aims to prevent unauthorized access via the charging port, while still allowing USB charging. Connections established while the phone is unlocked, such as for photo transfers, remain active after the screen locks.
The update also addresses the misuse of the AccessibilityService API, a common vector for fraud and scams. When Advanced Protection is enabled on Android 17, access to these services is automatically restricted to verified apps specifically classified as accessibility tools, thereby preventing malicious apps from exploiting them while preserving functionality for assistive technologies.
For browser security, Advanced Protection on Android 17 now disables WebGPU in Chrome. This technology allows websites to utilize a device’s graphics processor for complex tasks, including AI processing. Disabling it is intended to reduce exposure to advanced browser exploits. Additionally, Failed Authentication Lock, an existing Android theft protection feature that locks a device after repeated failed authentication attempts, is now integrated into Advanced Protection for selected Android 17 devices, helping to counter physical tampering and brute-force access attempts.
Finally, a new "View Supporting Apps" settings page provides transparency by showing users which installed applications check for the status of Advanced Protection. This allows developers to be notified when a user enables Advanced Protection, enabling their apps to automatically activate additional security and privacy features. Existing Advanced Protection users will receive notifications as these new capabilities become available on their devices.
