Google adds Android security-state libraries for component-level patch checks

Apps can now check patch status by component, which gives security-sensitive software a clearer view before it allows risky actions.

Google has added AndroidX Security State and Security State Provider libraries so Android apps can check patch status by component instead of relying only on one device-wide patch date. That matters for security-sensitive apps and MDM tools because they can now verify whether the system, Play-updated modules, or kernel have the fixes they need before allowing risky actions. The libraries define Device SPL, Published SPL, and Available SPL, giving developers a way to compare what is installed, what Google has released, and what can still be downloaded. The APIs include queries for pending updates, CVE checks, a full-update test, and a URL generator for bulletin and CVE details. Google also says the companion provider library lets OEM update clients signal availability in a standard way, without apps needing to know whether the update came from Google Play, Google’s OTA client, or an OEM client.