Google Releases Libraries for More Granular Android Security Patch Information

Google has released new AndroidX Security State libraries that provide more granular information about the security patches on individual device components. The libraries, which include the stable Security State v1.1.0 and Security State Provider v1.0.0, allow developers to check the security status of core Android operating system, system modules updated through Google Play system updates, and the Linux kernel.

The new libraries offer three levels of security patch information: Device Security Patch Level (DSPL), Published Security Patch Level (PSPL), and Available Security Patch Level (ASPL). The DSPL shows what is currently installed and running on the device, while the PSPL shows the latest patches officially published in the Android Security Bulletin. The ASPL, on the other hand, shows what is available for that particular device to download and install.

The libraries can also check specific high-risk vulnerabilities tracked as CVEs and verify whether critical NFC or Bluetooth fixes are installed before enabling features such as tap-to-pay or proximity-based data sharing. Google said this more detailed information can help security-sensitive apps decide whether to allow certain actions, such as high-value payments or credential enrollment.