NewApp Digest
search bot

patch levels

Google's Android Security State Libraries Enable Component-Level Security Verification
AppWizard
October 5, 2026

Google’s Android Security State Libraries Enable Component-Level Security Verification

Google has launched AndroidX Security State libraries, enabling applications to verify security patch status at a granular level for individual components. This allows developers to conduct precise security verifications tailored to their applications' needs. The libraries categorize security patch levels into Device SPL, Published SPL, and Available SPL, providing enhanced visibility into device security. Functions such as queryAllAvailableUpdates() and areCvesPatched() help identify pending updates and check CVE status. The Security State Provider library standardizes communication for update notifications among OEMs.
Android apps can now check security patches down to individual device components
AppWizard
September 18, 2026

Android apps can now check security patches down to individual device components

The new AndroidX Security State libraries, with stable releases of Security State v1.1.0 and Security State Provider v1.0.0, allow developers to evaluate the security status of individual device components. They provide three levels of security patch information: Device Security Patch Level (DSPL), Published Security Patch Level (PSPL), and Available Security Patch Level (ASPL). These libraries enable checks on critical components of the Android operating system, including system modules and the Linux kernel, which are represented by version numbers rather than monthly patch dates. Applications that prioritize security can utilize this detailed patch information to assess vulnerabilities, particularly those tracked as Common Vulnerabilities and Exposures (CVEs). The libraries also integrate with the Open Source Vulnerabilities (OSV) database for access to Android Security Bulletin data and device-specific vulnerability reports. Additionally, Android 17 allows manufacturers to declare individual security fixes beyond the stated security patch level, and Google is working with manufacturers to transition their OTA update clients to this new standardized system.
Search