Google is tightening one of Android's most frequently abused permission systems. In Android 17, devices using Advanced Protection will limit the AccessibilityService interface to verified applications formally categorized as accessibility tools.
The interface exists for legitimate and important reasons. Screen readers, voice-control software and other assistive applications need extensive visibility into the user interface. Those capabilities can include reading screen content, observing user actions and interacting with applications on the user's behalf.
Unfortunately, the same privileges have become valuable to banking trojans, spyware and fraud applications. After persuading a victim to enable an accessibility service, malicious software may capture keystrokes, display fraudulent login overlays, approve additional permissions, interfere with removal or automate transfers inside financial applications.
A stronger security boundary
Advanced Protection already enables a collection of hardened Android settings for users facing elevated risk. Android 17 will extend that model by preventing ordinary or unverified applications from obtaining accessibility privileges when the mode is active.
This is a meaningful shift because Google is moving beyond warning users and placing a technical restriction around a high-risk capability. Previous defenses have included blocking some sideloaded applications from enabling accessibility services, protecting sensitive interface elements and preventing users from changing certain security settings during suspicious calls.
Android 17 will also add intrusion logging for investigations, USB protections against physical access, an option to disable WebGPU, stronger locking after failed authentication attempts and a way to identify applications that check whether Advanced Protection is enabled.
What organizations should do
- Evaluate Advanced Protection for executives, administrators and employees with access to financial systems.
- Inventory legitimate accessibility applications before enabling stricter policies.
- Use managed Google Play and mobile device management controls to limit sideloading.
- Educate users that accessibility permission requests from financial, delivery or media applications are suspicious.
- Test business applications to ensure the new restrictions do not disrupt required workflows.
I believe the change addresses the problem at the correct layer. User education remains useful, but permission dialogs cannot carry the entire burden when criminals deliberately design instructions that appear trustworthy. Restricting a powerful interface to verified software removes opportunities rather than merely asking users to recognize them.
The tradeoff will be verification quality. Google must ensure that legitimate assistive technology developers can qualify without excessive cost or delay. If implemented carefully, however, the control could substantially raise the cost of mobile banking fraud while preserving accessibility for the people who genuinely depend on it.