Android Security State now gives enterprise apps and device makers a component-level view of patch status instead of forcing them to trust one blanket security patch date. Google announced stable AndroidX Security State 1.1.0 and Security State Provider 1.0.0 on September 17, 2026.
Key takeaways
- The libraries separate the patch level installed on a device, the latest published level and an update already available to install.
- Apps can evaluate the operating system, modular system components and kernel independently.
- Android 17 lets manufacturers declare supplemental fixes applied above the displayed patch level.
- The practical payoff is narrower access control: block a sensitive action only when a relevant fix is genuinely missing.
Everyone else is reporting a new Android security API; we are explaining how it can reduce both false confidence and unnecessary lockouts in bring-your-own-device fleets.
Why Android Security State was needed
Android’s old patch-level string was built for a simpler update model. Today, the operating system, Google Play system modules, kernels and manufacturer packages can move on different schedules. A phone may display an older date while already carrying a backported fix, or display a current date while an important component update is waiting to be installed.
Google’s new libraries expose three measurements. Device Security Patch Level, or DSPL, is what is installed and running. Published Security Patch Level, or PSPL, is the latest level in Android’s public bulletins. Available Security Patch Level, or ASPL, is a newer update that an on-device update client reports as ready.
What developers and device makers can do
An app can compare patch levels before unlocking a payment, health or corporate-data feature. It can also check specific CVEs through Android’s public vulnerability data rather than treating every monthly date change as equally important. Google says the available-state query communicates only with trusted on-device providers holding a privileged phone-state permission.
For device makers and over-the-air clients, Security State Provider standardizes how update availability is exposed through Android IPC. Google Play system updates already publish available-state information on GMS devices, and Google says its OTA client is onboarded while it works with other manufacturers.
Android Authority independently confirmed the stable releases and the shift from a single date to per-component checks. Google’s developer documentation supplies the implementation details and makes an important limitation explicit: the library measures software patch compliance, not hardware authenticity, app licensing or tampering. Those checks still require mechanisms such as Play Integrity.
| Signal | What it answers |
|---|---|
| DSPL | Which patch level is installed and running? |
| PSPL | What level has Android officially published? |
| ASPL | Is a newer update already available on this device? |
| CVE check | Is a specific vulnerability fixed for this configuration? |
The release follows a busy Android security cycle. Google recently patched an actively exploited Pixel flaw, covered in our Pixel CVE-2026-58704 guide. The broader operational lesson resembles Apple’s 200-plus security fixes: a patch program needs evidence that the relevant device state actually changed, not just a release announcement.
The enterprise consequence
The new model can make zero-trust policies more precise. A bank could block tap-to-pay only when an NFC fix is absent, while an employer could prompt a user to install a staged update before opening sensitive data. It can also recognize a backported fix above a manufacturer’s headline patch date.
Adoption is the remaining dependency. Available-state accuracy improves only as more OEM update clients publish trustworthy data, and administrators still need to decide which gaps justify restricting access.
Android Security State turns patch compliance from a single-date proxy into a component-level decision: installed, published and available fixes can now be evaluated before an app grants sensitive access.
FAQs
What is Android Security State?
Android Security State is an AndroidX library that gives apps a unified, component-level view of device software patch status and relevant vulnerabilities.
Does it install Android updates?
No. It reports installed, published and available security states so an app can allow access, limit a feature or guide the user to install an update.
Does it replace Play Integrity?
No. Google says Security State covers software patch posture, while Play Integrity addresses authenticity, tampering and related trust signals.
Get the day’s top stories in your inbox
One concise email. No spam, unsubscribe anytime.
