With the increasing threat of mercenary spyware and targeted attacks, major tech companies like Apple, Google, and Microsoft are working to protect vulnerable users globally. Following the introduction of Apple’s Lockdown Mode for iOS in 2022, which maximizes security at the cost of functionality, Google is expanding its Advanced Protection program for Android users.
On May 13, 2025, Google announced an Advanced Protection mode for Android 16, designed to enhance security for at-risk individuals like activists, journalists, and public figures. This mode imposes strict security settings on apps and services to isolate user data and minimize contact with insecure services and unknown parties. Google aims to maintain usability while providing robust protections, leveraging its AI technologies for monitoring without sacrificing essential features. However, certain restrictions are permanent, such as disabling connections to outdated 2G networks and altering Chrome’s JavaScript optimizer to reduce vulnerabilities.
According to Dave Kleidermacher, vice president of engineering in Android’s security division, the strategy focuses on both hardening the system to prevent attacks and enhancing detection capabilities to respond effectively if a compromise occurs. A new feature called Intrusion Logging uses end-to-end encryption to securely store logs in the cloud, making them accessible only to users. This ensures that users can analyze their security status without fear of alteration or deletion by attackers.
While such monitoring has traditionally been limited to enterprise environments, Google’s foray into consumer mobile security introduces notable features. Despite the potential risks associated with cloud-based data storage, Kleidermacher emphasizes the log’s resistance to tampering as a significant advancement in consumer-level intrusion detection.
Another default feature in Advanced Protection is Android’s Memory Tagging Extension (MTE). This hardware-level protection prevents exploitation of memory vulnerabilities, effectively neutralizing common hacking techniques like buffer overflows.
The primary features of Advanced Protection are set to roll out alongside Android 16, with Intrusion Logging slated for release later in the year, along with enhanced USB protections to prevent unauthorized data access from peripherals. Additionally, Google will provide an API for third-party apps to take advantage of these security features. Kleidermacher notes that these integrations will enhance security across a wider range of applications, making it significantly more difficult for attackers to succeed.
By implementing these stringent security measures, Google aims to create a safer environment for vulnerable users on mobile platforms, making it harder for attackers to compromise devices or access sensitive information.
