Google’s new Android sideloading process aims to curb malware but retains workarounds

Google introduces a verification system for sideloaded apps, adding friction while maintaining workarounds, in a bid to enhance security amid expanding third-party app stores.

Google is reshaping Android sideloading with a new developer-verification system that will add friction without removing the option entirely. The change begins in September 2026 in Brazil, Indonesia, Singapore and Thailand, before expanding globally in 2027, according to Google’s support material and several industry reports. For users on certified Android devices, the key shift is that apps distributed outside Google Play will increasingly need to be linked to a verified developer before they can be installed. Google says the aim is to reduce scams, malware and abuse of anonymity rather than to vet app content itself.

In practical terms, the first phase covers apps distributed through participating stores, including Google Play, Samsung’s Galaxy Store, Xiaomi GetApps, OPPO App Market, HONOR App Market, Vivo’s V-Appstore and Transsion’s Palm Store, before the policy widens to all sources in 2027. Developers distributing outside Play are expected to use a new Android Developer Console, with a $25 registration route for full distribution and a separate limited account for students and hobbyists. That lower-cost option avoids government-ID checks but caps distribution at 20 devices, according to Google’s documentation and reporting from Android-focused outlets.

Google is also offering an escape hatch for people who still want to install software from unverified developers. The so-called advanced flow, which began rolling out in August, adds several steps: enabling Developer Options, allowing apps from unverified developers, restarting the phone, waiting through a one-time 24-hour delay and then confirming the choice again with a PIN, password or biometric check. Once completed, users can allow such apps for seven days or indefinitely, and Google says the process is designed to interrupt coercion scams that rely on urgency and live social engineering.

There is still a technical bypass. Android Debug Bridge, or ADB, remains exempt, so users comfortable installing apps from a computer can continue to sideload without going through the advanced flow. That means the new system does not eliminate sideloading; it mainly makes everyday, phone-only installs from unregistered developers more deliberate. Google has also said the change reflects its finding that malware is far more common in sideloaded sources than in Google Play.

The timing is notable because the same platform is also being opened more widely to rival app stores in the United States after Google’s antitrust fight with Epic Games. Third-party storefronts can now be distributed through Google Play, and Aptoide has already become the first rival store available that way. That makes Google’s approach look dual-track: more commercial openness at the store level, but tighter identity control underneath. Supporters will see that as a sensible security trade-off; critics, including free-software groups, argue that it gives Google more power over independent distribution and weakens Android’s traditional openness.