Android Partner Vulnerability Initiative

Google launches Android Partner Vulnerability Initiative

Google now discloses Android vulnerabilities for 3rd-party devices

Google has launched the Android Partner Vulnerability Initiative (APVI), a new program specifically designed to deal with security vulnerabilities the company finds in third-party Android devices and software serviced by Android OEMs.

This program adds to Google’s other initiatives surrounding its efforts to discover and address Android security issues with the help of security researchers and the Android community including the Android Security Rewards Program (ASR) (for Android system) and the Google Play Security Rewards Program (for third-party apps).

Issues affecting the Android Open Source Project (AOSP) impact all Android devices and are disclosed through ASR reports released via Android Security Bulletins (ASB) each month.

However, vulnerabilities Google discovers outside of the Android Open Source Project (AOSP) based code that only affect a small subset of Android OEM devices weren’t previously disclosed via a public program.

The APVI initiative fixes this and improves overall Android OEM device security by letting users know when Google finds security bugs in Android device code that is not serviced or maintained by Google.

Android Partner Vulnerability Initiative

Commenting on the initiative, Kylie McRoberts, Program Manager and Alec Guertin, Security Engineer explained:

Google’s Android Security & Privacy team has launched the Android Partner Vulnerability Initiative (APVI) to manage security issues specific to Android OEMs. The APVI is designed to drive remediation and provide transparency to users about issues we have discovered at Google that affect device models shipped by Android partners.

The APVI covers Google-discovered issues that could potentially affect the security posture of an Android device or its user and is aligned to ISO/IEC 29147:2018 Information technology — Security techniques — Vulnerability disclosure recommendations. The initiative covers a wide range of issues impacting device code that is not serviced or maintained by Google (these are handled by the Android Security Bulletins).

The APVI has already processed a number of security issues, improving user protection against permissions bypasses, execution of code in the kernel, credential leaks and generation of unencrypted backups

Google provided several examples of vulnerabilities .previously discovered in Android OEM devices including a permission bypass issue impacting a third-party pre-installed over-the-air (OTA) update tool, credential leaking via the built-in password manager of a popular pre-installed web browser, and unnecessary permissions access for privileged apps.

Rapid Mobile

Rapid Mobile uses cookies, tokens, and other third party scripts to recognise visitors of our sites and services, remember your settings and privacy choices, and - depending on your settings and privacy choices - enable us and some key partners to collect information about you so that we can improve our services and deliver relevant ads.

 

By continuing to use our site or clicking I Accept, you agree that Rapid Mobile and our key partners may collect data and use cookies for personalised ads and other purposes, as described more fully in our privacy policy.

 

You can change your settings at any time by clicking Manage Settings or by visiting our Privacy Centre for more detailed information.

 

Privacy Settings saved!
Cookie Services

When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies.Because we respect your right to privacy, you can choose not to allow some types of cookies. Click on the different category headings to find out more and change our default settings. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer.

These cookies allow us to count visits and traffic sources, so we can measure and improve the performance of our site.

We track anonymized user information to improve our website.
  • _ga
  • _gid
  • _gat

Decline all Services
Accept all Services