Google Tightens Android Accessibility API Access for Users in Advanced Protection Mode

Google announced a new security restriction for Android devices that activates when a user enables Advanced Protection, the company’s highest‑security account setting. Under the new rule, only applications that have been vetted and classified as official Accessibility Tools will be permitted to interact with the platform’s Accessibility Services API.

The change comes after a surge in malicious apps exploiting the Accessibility Services framework to gain elevated privileges, capture user input, and perform actions without consent. By limiting access to verified tools, Google aims to close a widely abused vector that has been leveraged for credential theft, ad fraud, and unauthorized data collection.

Advanced Protection is primarily marketed to high‑risk individuals such as journalists, activists, and public figures. When turned on, it already enforces stricter authentication and blocks third‑party sign‑in attempts. The new accessibility limitation adds another layer, ensuring that even if a compromised app is installed, it cannot tap into the powerful accessibility APIs unless it has passed Google’s verification process.

Developers of legitimate accessibility applications—such as screen readers, voice control, and alternative input solutions—will need to ensure their apps are listed in Google Play’s Accessibility Tools category and meet the required security standards. Google indicated that existing compliant apps will retain functionality, while non‑compliant ones will be blocked from accessing the API on devices with Advanced Protection enabled.

Security researchers have long warned that the Accessibility Services API is one of the most permissive entry points on Android, granting apps the ability to read screen content, simulate touches, and manipulate other apps. Past incidents have shown that threat actors can bundle such capabilities into seemingly innocuous utilities, making detection difficult for average users.

The rollout is expected to begin in the coming weeks, with the change automatically applied to devices linked to Google accounts that have Advanced Protection turned on. Users who do not use Advanced Protection will see no immediate impact, though the measure signals Google’s broader intent to harden the Android ecosystem against abuse.

Industry observers note that the move may prompt further scrutiny of other high‑privilege Android APIs and could lead to additional safeguards for standard users in the future. For now, the restriction offers a concrete protection for the most vulnerable users, reducing the attack surface that malicious developers have historically exploited.