Android 17 Advanced Protection: 6 New Anti-Spyware Defenses

Google announced six new features for Android's Advanced Protection mode on October 1, 2026, aimed at people most likely to face sophisticated spyware, such as journalists, activists and public figures. The headline addition, Intrusion Logging, gives defenders something mobile platforms have rarely offered: a durable forensic record of what happened on the device.

• Intrusion Logging stores end-to-end encrypted security and network event logs in the cloud for 12 months, then deletes them automatically.
• USB Protection sets new USB connections to charge-only while the phone is locked, on Pixel 6 and later and select Android 17 devices.
• Accessibility services are limited to verified apps, and WebGPU is turned off in Chrome to shrink the browser attack surface.
• A Failed Authentication Lock and a View Supporting Apps page round out the six features.

What Is Android Advanced Protection?

Advanced Protection is Android's strongest security setting, one switch that turns on a bundle of hardened defaults. It trades a little convenience for a much smaller attack surface. Google's update, written by Group Product Manager Il-Sung Lee, expands that bundle with defenses aimed at the techniques modern spyware relies on.

How Does Intrusion Logging Help Investigators?

When a high-risk user suspects their phone was targeted, the hardest part is often proving it. Intrusion Logging records security, network and app events, encrypts them end to end and keeps them in Google's cloud for 12 months before automatic deletion. Investigators then have a trustworthy timeline to work from, even if an attacker tries to cover their tracks on the device. Users must opt in separately from the main Advanced Protection toggle. Help Net Security reports that Donncha Ó Cearbhaill of Amnesty International's Security Lab called it the first purpose-built forensic logging on a consumer mobile platform.

What Do the Other Five Features Do?

Each one closes off a known path into the phone:

• USB Protection: while the device is locked, any new USB connection defaults to charging only, which blocks data-extraction tools that rely on physical access. Google notes it may affect charging speeds.
• Accessibility protection: in Android 17, only verified accessibility tools can use AccessibilityService, so malicious apps cannot abuse it to read the screen or install malware.
• WebGPU disabled: turning off WebGPU in Chrome removes a complex graphics interface that sophisticated browser exploits could target.
• Failed Authentication Lock: repeated failed unlock attempts trigger a device lockdown, slowing brute-force attempts. It arrives on select Android 17 devices.
• View Supporting Apps: a new page shows which installed apps detect and respect Advanced Protection, which adds transparency for users.

Who Should Turn On Advanced Protection?

Anyone whose work or public profile makes them a likely target should consider it, and Help Net Security reports that existing users will get a notification as features arrive. The approach mirrors a broader trend toward secure-by-default design that we have tracked in stories like passkey transfer between password managers. More defensive security news lives in our AI security section.

Sources: Google Blog — October 1, 2026; Help Net Security — October 2, 2026.