The change targets a familiar abuse pattern, malicious Android apps have leaned on the accessibility API as their primary channel for malware delivery and financial fraud. By limiting which apps can reach those services, Google aims to cut off what it describes as a major attack pathway. Advanced Protection, the platform's opt-in hardening mode, is the context in which this restriction takes effect.

Key points:

• Accessibility services in Android 17 will only be reachable by apps verified and classified as Accessibility Tools.
• The restriction applies when Advanced Protection is enabled.
• Google frames the accessibility API as the main conduit for malware and financial fraud on Android.
• The stated goal is to block a significant attack pathway rather than patch a single flaw.

No specific advisory or tracking identifier was provided in the source material, so none is cited here. Watch for Google's developer guidance on verification requirements if your organization ships or depends on accessibility-based tooling.

Source: The Hacker News
Does your organization rely on accessibility services for legitimate automation or support tools, and how would this restriction affect those workflows?