Mobile & Wireless

Google Announces Android Partner Vulnerability Initiative

Google on Friday announced the Android Partner Vulnerability Initiative (APVI), an effort aimed at improving patching of security issues specific to Android OEMs.

Ionut Arghire

October 5, 2020

Google on Friday announced the Android Partner Vulnerability Initiative (APVI), an effort aimed at improving patching of security issues specific to Android OEMs.

Through the new initiative, the tech giant also expects to improve transparency around vulnerabilities identified by Google’s own researchers, but which impact device models coming from the company’s Android partners.

Google already provides security researchers with various programs through which they can report security issues, such as the Android Security Rewards Program (ASR), which is for reporting vulnerabilities in Android code, and the Google Play Security Rewards Program, for reporting bugs in popular third-party Android apps.

ASR reports that have a broad impact on Android-based devices are delivered to the Android Open Source Project (AOSP) base code, as part of the Android Security Bulletins (ASB), and all partners are required to adopt these security changes for their devices in order to be able to declare a specific month’s Android security patch level (SPL).

“But until recently, we didn’t have a clear way to process Google-discovered security issues outside of AOSP code that are unique to a much smaller set of specific Android OEMs. The APVI aims to close this gap, adding another layer of security for this targeted set of Android OEMs,” Google explains.

All issues discovered within Google and which could potentially impact the security of an Android device are covered by the APVI. A variety of security bugs affecting code not maintained by Google are included here, the company says.

The initiative has already kicked off and various types of security issues have been processed, including permission bypass, code execution within the kernel, leak of credentials, and the generation of unencrypted backups.

As part of the program, Google-discovered vulnerabilities will be publicly disclosed on Google’s Chromium portal. Detailed information on issues that have already been disclosed is also found there.

Written By Ionut Arghire

Ionut Arghire is an international correspondent for SecurityWeek.

Latest News

Click to comment

Dealing With the Carcinization of Security

Varied viewpoints as related security concepts take on similar traits create substantial confusion among security teams trying to evaluate and purchase security technologies.

Marc Solomon

Stop, Collaborate and Listen: Disrupting Cybercrime Networks Requires Private-Public Cooperation

No one combatting cybercrime knows everything, but everyone in the battle has some intelligence to contribute to the larger knowledge base.

Derek Manky

How the Atomized Network Changed Enterprise Protection

Our networks have become atomized which, for starters, means they’re highly dispersed. Not just in terms of the infrastructure – legacy, on-premises, hybrid, multi-cloud, and edge.

Matt Wilson

Mapping Threat Intelligence to the NIST Compliance Framework Part 2

How threat intelligence is critical when justifying budget for GRC personnel, and for threat intelligence, incident response, security operations and CISO buyers.

Landon Winkelvoss

Password Dependency: How to Break the Cycle

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the password dependency cycle. But how can this be done?

Torsten George