AndroidX Security State Libraries: Unified Device Security Monitoring
New APIs provide granular security patch visibility across Android components.
1Centralized security monitoring
The AndroidX Security State libraries (v1.1.0) and Security State Provider (v1.0.0) introduce a unified framework for tracking device security across the Android ecosystem. These libraries replace the monolithic Security Patch Level (SPL) approach with granular component-level monitoring. They're particularly valuable for banking, fintech, healthcare apps and MDM solutions, enabling programmatic verification of device security states. The system tracks three distinct patch levels per component: currently installed (DSPL), officially published (PSPL), and available updates (ASPL).
2Component-level security breakdown
The libraries monitor patch levels across three critical Android components: the core OS (updated via standard OTAs), modular subsystems (updated via Google Play system updates), and the kernel (evaluated via LTS versions). This granular approach helps developers understand exactly which components are secure, identify missing patches, and take proactive remediation steps. Unlike the previous single SPL indicator, the new system can differentiate between installed protections, available updates, and published standards for each component separately.
3Context-aware security decisions
Developers can now make smarter access decisions by combining DSPL, PSPL, and ASPL data. For example, banking apps can check pending updates (ASPL) before authorizing high-value transactions. The system also allows querying specific high-risk vulnerabilities (CVEs), enabling apps to verify critical NFC or Bluetooth fixes are in place before enabling tap-to-pay or proximity features. This represents a shift from binary access decisions to context-aware security policies based on actual component protection states.
4Standardized update reporting
The Security State Provider library creates a standardized IPC mechanism for update clients to report availability. Previously, OTA update information was siloed within proprietary clients. Now, apps can access ASPL details through a unified API regardless of whether updates come from OEM OTAs or Google Play. Google has already onboarded its Play system updates and GOTA, with ongoing efforts to bring OEM OTA clients into this standardized framework.
5Beyond patch level strings
The libraries integrate with the Open Source Vulnerabilities (OSV) database to provide deeper security insights. They can determine if a monthly update contains new threats for specific components, automatically adjusting security level indicators accordingly. A new Android 17 feature allows OEMs to declare backported fixes via Supplemental Patches XML files, enabling immediate compliance recognition without waiting for full SPL updates. This ensures continuous patching efforts are properly credited.
6Enterprise security workflows
Enterprise apps can implement three key security workflows: synchronous posture checks (comparing DSPL with PSPL on app launch), pending update prompting (guiding users to install available updates), and vulnerability-level auditing (downloading OSV reports to verify specific CVE resolutions). These capabilities allow organizations to enforce security baselines while providing users with clear remediation paths rather than outright access denials.
7Implementation paths
App developers and MDM providers can start using the androidx.security.state library to evaluate real-time patch postures, with guidance available in the official documentation. OEMs and update clients can onboard to the Security State Provider framework to expose ASPL data. The system supports immediate credit for backported patches through Supplemental Patches XML files. Complete changelogs and API signatures are available in the AndroidX Release Notes for both libraries.
8Ecosystem-wide impact
These libraries represent a fundamental shift in Android security visibility, moving from opaque monolithic indicators to transparent component-level monitoring. By standardizing update reporting and integrating with vulnerability databases, they enable more nuanced security decisions while recognizing continuous patching efforts. The framework benefits the entire ecosystem—from app developers needing granular controls to enterprises requiring compliance verification and OEMs seeking credit for security investments.