password. Marking a device as lost also now enables additional protections like hiding Quick Settings and disabling new Wi-Fi and Bluetooth connections.

https://preview.redd.it/0ytfjo09ko7h1.png?width=1080&format=png&auto=webp&s=acebd6093d7f009ab5c85328c5c8a6c85201c1ed

**Protecting your SMS OTPs from scammers**

Scammers often try to hijack your one-time passwords (OTPs) to gain access to your accounts. To do this, they may deploy malicious apps that ask for permission to read your SMS. In Android 16, we introduced a protection that delays the delivery of messages containing an SMS retriever hash to most apps for three hours. Android 17 now extends this protection to all SMS messages containing an OTP. This means that even if a malicious app has been granted the SMS permission, it won’t be able to read your sensitive OTPs until after they have already expired.

**New core protections for Advanced Protection**

With Android 16, we introduced [Advanced Protection](https://security.googleblog.com/2025/05/advanced-protection-mobile-devices.html), a single, opt-in device-level security setting that enables all of Android’s highest security features. We’ve been working to expand the protections offered under this setting with key upgrades like USB protection and Intrusion Logging, and now with Android 17, we’re continuing this work by introducing the following protections:

* Removing access to the accessibility service from all apps that aren’t labeled as accessibility tools.
* Disabling device-to-device unlocking
* Blocking Chrome WebGPU support
* Integrating scam detection for chat notifications
* (Later this year) Enabling Android Enterprise support so organizations can enable Advanced Protection by policy for managed devices.

**Improving safety against malicious apps**

Live Threat Detection is a real-time security feature that analyzes app behavior to alert you if an app starts acting suspiciously, and we're enhancing it to find and protect against more types of malicious apps.

With dynamic signal monitoring, Android will be able to warn you about apps that start doing things like changing or hiding their icon and then launching activities in the background or abusing accessibility permissions. To do this, Live Threat Detection will monitor application system interactions for known suspicious patterns in real time. Dynamic signal monitoring will be enabled on select Android 17 devices starting in the second half of the year.

**Other enhancements**

* **Discrete password visibility settings for touch and physical keyboards:** Currently, by default, characters that you enter into password fields are briefly displayed as you type. Toggling the “show passwords” setting in Privacy controls allows you to hide characters as you type them into password fields. This setting currently applies to both touch-based inputs as well as physical keyboards, but in Android 17, we are splitting it into two distinct preferences. By default, characters entered into password fields via physical keyboards will now be hidden immediately to enhance privacy. Characters entered via touch input will continue to briefly be displayed to compensate for the lack of tactile feedback.
* **User-agent reduction for WebView:** The default User-Agent string in Android WebView has been shortened in Android 17 to minimize passive fingerprinting.
* **Disable 2G toggle:** Android 17 introduces a new capability for the [disable 2G toggle](https://source.android.com/docs/security/features/cellular-security/disable-2g). Carriers now have the ability to configure the default status of this setting, allowing them to disable 2G access to proactively shield their users from legacy technology vulnerabilities in areas where 2G infrastructure is no longer maintained.
* **Location Network Permission:** Android 17 introduces a new runtime permission to protect users from unauthorized local network access. This new requirement prevents malicious apps from exploiting unrestricted local network access for covert user tracking and fingerprinting.
* **Android OS