Enhancing Android security: Stop malware from snooping on your app data

Posted by Bennet Manuel, Product Management, Android App Safety and Rob Clifford, Developer Relations




Security is foundational to Android. We partner with you to keep the platform safe and protect user data by offering powerful security tools and features, like Credential Manager and FLAG_SECURE. Every Android release brings performance and security enhancements, and with Android 16, you can take simple, significant steps to strengthen your app’s defenses. Check out our video or continue reading to learn more about our enhanced protections for accessibility APIs.



Protect your app from snooping with a single line of code

We’ve seen that bad actors sometimes try to exploit accessibility API features to read sensitive information, like passwords and financial details, directly from the screen and manipulate a user's device by injecting touches. To combat this, Android 16 provides a new, powerful defense in a single line of code: accessibilityDataSensitive.

The accessibilityDataSensitive flag allows you to explicitly mark a view or composable as containing sensitive data. When you set this flag to true on your app, you are essentially blocking potentially malicious apps from accessing your sensitive view data or performing interactions on it. Here is how it works: any app requesting accessibility permission that hasn't explicitly declared itself as a legitimate accessibility tool (isAccessibilityTool=true) is denied access to that view.

This simple but effective change helps to prevent malware from stealing information and performing unauthorized actions, all without impacting users’ experience of legitimate accessibility tools. Note: If an app is not an accessibility tool but requests accessibility permissions and sets isAccessibilityTool=true, Play will reject it and Google Play Protect will block it on user devices. 

Automatic, enhanced security for setFilterTouchesWhenObscured protection

We’ve already integrated this new accessibilityDataSensitive security functionality with the existing setFilterTouchesWhenObscured method. 

If you already use setFilterTouchesWhenObscured(true) to protect your app from tapjacking, your views are automatically treated as sensitive data for accessibility. By enhancing the setFilterTouchesWhenObscured method with accessibilityDataSensitive protections, we’re instantly giving everyone an additional layer of defense with no extra work.

Getting started

We recommend that you use setFilterTouchesWhenObscured, or alternatively the accessibilityDataSensitive flag, on any screen that contains sensitive information, including login pages, payment flows, and any view displaying personal or financial data.

For Jetpack Compose

setFilterTouchesWhenObscured

accessibilityDataSensitive


val composeView = LocalView.current DisposableEffect(Unit) { composeView.filterTouchesWhenObscured = true onDispose { composeView.filterTouchesWhenObscured = false } }


Use the semantics modifier to apply the sensitiveData property to a composable.

BasicText { text = “Your password”,

            modifier = Modifier.semantics {

                sensitiveData = true }}




For View-based apps

In your XML layout, add the relevant attribute to the sensitive view.

setFilterTouchesWhenObscured

accessibilityDataSensitive


<TextView android:filterTouchesWhenObscured="true" />



<TextView android:accessibilityDataSensitive="true" />



Alternatively, you can set the property programmatically in Java or Kotlin:

setFilterTouchesWhenObscured

accessibilityDataSensitive


myView.filterTouchesWhenObscured = true;



myView.isAccessibilityDataSensitive = true;



myView.setFilterTouchesWhenObscured(true)



myView.setAccessibilityDataSensitive(true);



Read more about the accessibilityDataSensitive and setFilterTouchesWhenObscured flags in the Tapjacking guide.



Partnering with developers to keep users safe

We worked with developers early to ensure this feature meets real-world needs and integrates smoothly into your workflow.

 "We've always prioritized protecting our customers' sensitive financial data, which required us to build our own protection layer against accessibility-based malware. Revolut strongly supports the introduction of this new, official Android API, as it allows us to gradually move away from our custom code in favor of a robust, single-line platform defense."

- Vladimir Kozhevnikov, Android Engineer at Revolut


You can play a crucial role in protecting your users from malicious accessibility-based attacks by adopting these features. We encourage all developers to integrate these features into their apps to help keep users safe.

Together, we can build a more secure and trustworthy experience for everyone.

#WeArePlay: How Matraquina helps non-verbal kids communicate

Posted by Robbie McLachlan, Developer Marketing




In our latest #WeArePlay film, we meet Adriano, Wagner and Grazyelle. The trio are behind Matraquinha, an app helping thousands of non-verbal children in more than 80 countries communicate. Discover more about their inspiring story and the impact on their own son, Gabriel.

Wagner, you developed Matraquinha for a deeply personal reason: your son, Gabriel. Can you tell us what inspired you to create this app for him?

My wife and I adopted our son at 10 months. We later found out he couldn’t speak and received a diagnosis of Autism, so we started researching ways to communicate with him and vice versa. The idea started with drawings of objects and phrases on cards for him to point to things he wanted. We wanted to make this more digital and so, with my brother Adriano’s help, we developed the Matraquinha app. 

How does the app work?

Wagner: The app has almost 250 drawings, like digital flashcards. The child points to a card and the app announces the name of the object, place or feeling. Parents then more clearly understand what their child needs. 

Grazyelle: As a mom, after Gabriel started using the app, he was able to communicate and that reduced his feeling of crisis a lot. Before, he would be frustrated. Now with the app, my son can tell me what he needs.



Matraquinha started as a personal app for your family, but is now helping users in over 77 countries. How did you achieve this scale? 

Adriano: When my brother came to me with the idea, we thought it would be for our family and had no idea it would turn into a global resource for more families. In the first week, we had 1 download. By the next year, we had 100,000 downloads, all organic with no ads. It showed us how important the app was to help families communicate with their non-verbal children.

Adriano: It’s truly incredible for us to be on Google Play because, even without being senior engineers, this tool gave us an opportunity—an entry point—to bring communication to other families. We use other tools like Firebase Analytics which lets us see which cards and categories people are using the most, this helps us when developing new versions.


What is next for Matraquinha, and what features are you most excited about bringing to the community?

We are adding an extra 500 real images to the app, because kids are growing and no longer want drawings as they become teenagers. We’re also creating a board that has pronouns, nouns, and verbs. So say, a child wants to let the parents know they like to eat hamburgers, they can tap on the different words and create a sentence. This gives them even more independence. We are also exploring ways to use AI to make the app even more personal and pursuing the same goal: ensuring every child can be heard.

Discover other inspiring app and game founders featured in #WeArePlay.

#WeArePlay: How Matraquina helps non-verbal kids communicate

Posted by Robbie McLachlan, Developer Marketing




In our latest #WeArePlay film, we meet Adriano, Wagner and Grazyelle. The trio are behind Matraquinha, an app helping thousands of non-verbal children in more than 80 countries communicate. Discover more about their inspiring story and the impact on their own son, Gabriel.

Wagner, you developed Matraquinha for a deeply personal reason: your son, Gabriel. Can you tell us what inspired you to create this app for him?

My wife and I adopted our son at 10 months. We later found out he couldn’t speak and received a diagnosis of Autism, so we started researching ways to communicate with him and vice versa. The idea started with drawings of objects and phrases on cards for him to point to things he wanted. We wanted to make this more digital and so, with my brother Adriano’s help, we developed the Matraquinha app. 

How does the app work?

Wagner: The app has almost 250 drawings, like digital flashcards. The child points to a card and the app announces the name of the object, place or feeling. Parents then more clearly understand what their child needs. 

Grazyelle: As a mom, after Gabriel started using the app, he was able to communicate and that reduced his feeling of crisis a lot. Before, he would be frustrated. Now with the app, my son can tell me what he needs.



Matraquinha started as a personal app for your family, but is now helping users in over 77 countries. How did you achieve this scale? 

Adriano: When my brother came to me with the idea, we thought it would be for our family and had no idea it would turn into a global resource for more families. In the first week, we had 1 download. By the next year, we had 100,000 downloads, all organic with no ads. It showed us how important the app was to help families communicate with their non-verbal children.

Adriano: It’s truly incredible for us to be on Google Play because, even without being senior engineers, this tool gave us an opportunity—an entry point—to bring communication to other families. We use other tools like Firebase Analytics which lets us see which cards and categories people are using the most, this helps us when developing new versions.


What is next for Matraquinha, and what features are you most excited about bringing to the community?

We are adding an extra 500 real images to the app, because kids are growing and no longer want drawings as they become teenagers. We’re also creating a board that has pronouns, nouns, and verbs. So say, a child wants to let the parents know they like to eat hamburgers, they can tap on the different words and create a sentence. This gives them even more independence. We are also exploring ways to use AI to make the app even more personal and pursuing the same goal: ensuring every child can be heard.

Discover other inspiring app and game founders featured in #WeArePlay.

A new web address for Google Chat

What’s happening

We’re launching a faster, more reliable Google Chat experience for web users. Chat will now be served from chat.google.com instead of mail.google.com/chat. Users, however, can continue to use existing mail.google.com/chat bookmarks and links. This change will reduce loading time when opening the app and does not change the Chat user interface.

Getting started

  • Admins and developers: If you've created an extension that works with Chat, you'll need to make sure it's compatible with the new chat.google.com web address. Please update your extension to ensure it can find and interact with Chat in its new home.
  • End users: If you’re using Chrome extensions to enhance Chat, they may need to be updated by their creators to function correctly after the move to chat.google.com. If you notice an extension isn't working as expected, check if an update is available on the Chrome Web Store.
  • Admins: If you've blocked Chat access for your org users using allowlist or block URLs in Chrome (or other browsers), then you will need to add the chat.google.com domain as well. If you've configured website-specific policies for permissions and behaviors (such as allowing or denying access to camera, microphone, notifications, etc.) for Chat, you will need to update these policies to include chat.google.com. Finally, if you've force installed the Chat desktop app (aka Chat PWA) for your organization through a force-install list, you will need to include chat.google.com in this list. Note that blocking chat.google.com will break your ability to use Chat within Gmail and Google Meet.

Rollout pace

  • Rapid Release domains: Extended rollout (potentially longer than 15 days for feature visibility) starting on December 11, 2025
  • Scheduled Release domains: Gradual rollout (up to 15 days for feature visibility) starting around January 7, 2025

Availability

  • Impacts all Google Workspace customers and users with personal Google accounts

Gmail data classification update: include header or footer message

What’s changing

Earlier this year, data classification labels for Gmail became generally available. Admins can use this feature to classify and audit email content according to organizational guidelines (“Sensitive,” “Confidential,” etc.) and apply policies, such as data loss prevention (DLP) rules, to protect sensitive information in email messages.

We have expanded this functionality to include the ability to create a DLP rule that adds a header or footer message to email messages. Critically, header and footer messages will be shown to users outside of your domain, which helps ensure external users are aware of the sensitivity of the message and any handling requirements. DLP rules are applied to outbound messages from your domain based on how you have configured the rule scope and conditions. As a reminder, the actual classification label is only visible to recipients in your domain.

Admins can customize the information shown in the header or footer message, including links to further information on handling information. Headers and footers are visible on all device types, both within and outside of your domain.

Selecting “Add footer message” when creating a rule

Selecting “Add footer message” when creating a rule

Once the email is sent, the banner will appear in the body of the email.

Once the email is sent, the banner will appear in the body of the email

For more information on data classification labels for Gmail, please refer to our previous announcement.

Getting started

Rollout pace

Availability

Data loss prevention rules with labels as a condition or labels as an action are available to:

  • Enterprise Standard and Plus
  • Education Fundamentals, Standard, Plus, and the Teaching & Learning Upgrade
  • Frontline Standard and Plus
  • Cloud Identity Premium (with Workspace plan that includes Gmail)

Resources