Full Breakdown
Android X Security State Libraries Provide Granular Visibility into Device Patch Levels
By Drooid · · How we work
New Libraries Deliver Component-Level Security Insight
Google announced the stable release of AndroidX Security State v1.1.0 and Security State Provider v1.0.0. The libraries give app developers, Mobile Device Management (MDM) solutions, and OEMs a programmatic way to query the security posture of individual device components rather than relying on a single Security Patch Level (SPL) string.
Limitations of the Traditional SPL Model
Google engineers explained that Android’s shift to modular updates—such as Google Play system updates and over-the-air (OTA) client updates—means a monolithic SPL no longer reflects the true protection status of a device. A single SPL value cannot indicate which components have received recent fixes or whether pending updates are staged for installation.
Three Patch Levels and CVE-Level Auditing
The libraries expose three distinct patch-level queries:
- Device Security Patch Level (DSPL) – the patch level currently installed and running on each component, obtained locally without network calls.
- Published Security Patch Level (PSPL) – the latest patch level published in the Android Security Bulletin for each component.
- Available Security Patch Level (ASPL) – the patch level ready to be downloaded and installed, reported asynchronously via inter-process communication with on-device update clients.
Developers can also download component-specific vulnerability reports from the Open Source Vulnerabilities (OSV) database, enabling audits of whether particular CVEs have been resolved. Kernel security levels are expressed with version numbers (e.g., 5.15.159, 6.1.91) rather than monthly dates.
Google’s Official Position
Google states that the libraries allow apps to perform “synchronous posture checks” at launch, compare DSPL with PSPL, and decide whether to grant access to sensitive corporate resources. For devices that are slightly behind, apps can query ASPL to prompt users to install pending updates instead of outright blocking access. The companion Security State Provider library standardizes how OTA clients expose update availability, unifying data from Google Play system updates, Google Over-The-Air (GOTA), and OEM-specific OTA solutions.
Impact on the Android Ecosystem
Enterprises can now enforce more precise security baselines for banking, fintech, and healthcare applications, reducing the risk of exposing high-value transactions to unpatched components. OEMs gain a mechanism to claim credit for back-ported fixes via Supplemental Patches XML files introduced in Android 17, ensuring continuous patching efforts are recognized immediately. By making component-level security data readily accessible, the libraries aim to improve overall device protection and streamline compliance for both developers and manufacturers.
