Android Q Adds Extra Precautions Against Overlay Permission Malware

Android Q is the next Android version, and it would come, of course, with significant changes. From a developer point of view, it appears that one of the most significant changes is one related to the SYSTEM_ALERT_WINDOW permission, which is the one that controls overlays.

The permission has been removed on the “Go” version of Android Q. Meanwhile the overlay permission is revoked by the latest Android Q beta for the apps installed via the Play Store if the device is rebooted. That is something that Android 9 Pie and earlier versions did not have. More than that, sideloaded apps on Android Q will have that permission revoked after 30 seconds.

Using overlay in Android Q

The permissions change on non-Go Android does make overlays frustrating, and it might determine users not to use them. For instance, if an app is relaunched, it will need overlay permission once again. If an app that uses that overlay is running, the overlay is still there even if the consent has been revoked.

Security reasons

Google did not announce these changes publicly, and we weren’t given a justification for them. However, it is not difficult to understand why the overlay permission changes were made. Apps can exploit overlays to capture input, and they can force users to perform actions without knowing.

Nonetheless, a better solution would have been deleting overlays entirely, as they are not safe enough. Instead, Google decided to choose half-measures. It is quite unlikely that the new 30-second restriction is the most efficient solution. However, looking at the way things evolve, there is a big chance that Google will remove permission entirely in the future, and this would be a great way of enhancing security.

At the moment, Android Q beta is the only preview we have on the upcoming Android OS. However, many beta versions would come out before Android Q rolls out in its final version.

You might like

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.