For years, Google has been improving the security on Android. Sideloaded apps are among the main access points for malware, so the company has restricted them from accessing certain sensitive permissions by default. Now, it seems that Android 15 will further restrict what sideloaded apps can do on your device.
Android 15 further restricts sideloaded apps from accessing sensitive permissions
Since Android 13, sideloaded apps have had a harder time getting accessibility permissions. Malicious apps often use them to try to breach the victim’s security and privacy, so Google has focused on adding additional layers of security. If a malicious app obtains accessibility permissions, it can use them to spy on your activity and capture your login credentials for services (including banking). They could even use them to prevent you from uninstalling the malicious app.
Users can manually enable access to such permissions if they are fully convinced that the app is trustworthy. Still, it is already quite useful that the OS restricts them by default. That said, it seems that Android 15 will bring a new set of permission restrictions for sideloaded apps. As reported by 9to5Google, Android 15’s CDD (Compatibility Definition Document) defines several new permissions not accessible by default by such apps.
These are the new restricted permissions
The list of restricted permissions divides them into three types. “Special permissions” include accessibility, notification listener, device admin, display over other apps, and usage access. The “Roles” permissions encompass dialer and SMS. Lastly, “Runtime permissions” includes access to SMS. Basically, the new restrictions aim to prevent inexperienced users from setting up potentially malicious apps as the default dialer or SMS manager. They also aim to prevent access to user notifications, activity tracking, and spying on their on-screen touches.
However, Android 15 will still allow enabling such permissions manually. The approach seems good both for increasing security and for maintaining the freedom to sideload apps. That said, Google also launched an API that prevents sideloaded apps from working if the developer wants to, forcing users to download the app from the Play Store.