Google announced the first beta version of Android 17, which includes several privacy and security enhancements.
Android developers have described several improvements related to performance, media and camera apps, connectivity, and developer productivity.
In terms of security and privacy, they unveiled two major changes: deprecation of a cleartext attribute, and introduction of a public Service Provider Interface (SPI) for HPKE hybrid cryptography.
The first, which aims to reduce risks associated with unencrypted traffic, is related to the usesCleartextTraffic attribute. On apps targeting Android 17, if the attribute is set to ‘true’ but lacks a corresponding network security configuration, cleartext traffic will be blocked by default.
Developers are advised to migrate to network security configuration files for more granular control.
The introduction of support for HPKE via a new SPI enables developers to implement secure hybrid encryption combining public-key and symmetric (AEAD) mechanisms. The goal is to facilitate stronger, more efficient encrypted communication in apps.
Android developers announced, “In Android 17, the platform continues its shift toward a ‘secure-by-default’ architecture, introducing a suite of enhancements designed to mitigate high-severity exploits such as phishing, interaction hijacking, and confused deputy attacks. This update requires developers to explicitly opt in to new security standards to maintain app compatibility and user protection.”
The release notes state that certificate transparency (CT) is enabled by default on Android 17 — apps had to opt in on Android 16.
Other improvements include a new install-time permission that aims to improve platform security and user privacy around localhost protections.
Android developers plan on achieving platform stability by March, and then testers will have several more months to review the mobile operating system until the final release becomes available.
Related: Android Zero-Days Patched in December 2025 Security Update
Related: New ‘ZeroDayRAT’ Spyware Kit Enables Total Compromise of iOS, Android Devices
Related: Critical Dolby Vulnerability Patched in Android
