Google advances Android 17 security with new measures to fight spyware and tampering

Google introduces enhanced security features in Android 17, including Intrusion Logging and tightened access controls, to combat spyware, scam apps, and device tampering, aiming for a more resilient mobile ecosystem.

Google is expanding its Advanced Protection framework in Android 17 with a broader set of defences aimed at spyware, scam applications and attempts to tamper with a handset. The system, which Google first introduced in Android 16 as an optional security mode, is being extended with six protections in total, including two new additions and several measures that have already begun to arrive gradually on supported devices.

The most significant new feature is Intrusion Logging, which creates an encrypted record of selected on-device activity. According to Google’s support pages, the log can capture events such as app installations, connections to other devices, screen unlock attempts and some browsing data. The records are stored in the user’s Google account for up to 12 months, so traces can remain available even if spyware tries to erase evidence from the phone itself.

Google says the feature is designed to help users and security specialists identify suspicious behaviour after a compromise has been suspected. The company’s documentation also notes that the logs can be downloaded and shared with trusted experts for forensic review. That makes the function more than a simple alert system: it is intended to preserve evidence in situations where a device may already have been manipulated.

Another newly highlighted protection restricts access to AccessibilityService, a powerful Android capability that malicious apps have sometimes abused to read on-screen content or control parts of the interface. By tightening that access, Google is trying to make it harder for fraudulent software to gain the permissions it needs to imitate legitimate behaviour or interfere with the user experience. The wider package also includes USB Protection, which is aimed at reducing the risk from unsafe charging accessories and data connections, and Failed Authentication Lock, which is intended to make repeated unauthorised access attempts less effective.

Google’s own security blog says the Android 17 rollout also includes View Supporting Apps, a feature meant to help users understand which apps are backing the security environment around Advanced Protection. The company presents the full package as a layered defence system rather than a single tool, with integration across Android services such as Chrome, Google Messages and Phone by Google. Google’s support material says Advanced Protection is designed for people who want a stronger default posture against online attacks, harmful apps and data theft, with device and account protection able to be managed from the same settings area.

For now, Google says some of the Android 17 protections are limited to selected devices, which suggests the rollout will not be identical across all phones at launch. Even so, the direction is clear: Google is turning Advanced Protection into a more comprehensive security suite, with particular emphasis on resisting stealthy surveillance, reducing the value of compromised accessories and preserving evidence when something goes wrong.