Android releases the AndroidX Security State libraries (Security State v1.1.0 and Security State Provider v1.0.0) to centralize visibility into device security posture and pending updates, with component-level patch reporting across the system, modules, and kernel.

These libraries enable apps and enterprise tools to determine if a device is missing important security patches, including backported fixes surfaced via Supplemental Patches XML.

The framework reports granular patch status using DSPL, PSPL, and ASPL, moving beyond a single patch date to reflect what is installed, published, and available for installation.

Developers can leverage use cases such as Synchronous Posture Checks, Pending Update Prompting, and Vulnerability-Level Auditing using OSV data.

Two practical benefits highlighted are accurate protection even if monthly updates miss new threats, and immediate recognition of backported fixes without waiting for SPL bumps.

Supplemental Patches XML support allows manufacturers to declare backported fixes ahead of full monthly updates, with those fixes surfaced to apps and management platforms.

Overall, the update provides a practical means for developers and enterprises to detect missing patches, identify pending fixes, and base security decisions on real component-level protection status.

Patch levels are tracked across the system, modules, and kernel, emphasizing modular updates via Google Play system updates and OTA mechanisms.

Checks cover core Android OS, Google Play system updates, and the Linux kernel, with kernel levels using version numbers rather than monthly patch dates.

The framework complements existing patch information and improves verifiability of a device’s security posture for critical functions like tap-to-pay or proximity data sharing.

Libraries integrate with Android Security Bulletin data via the OSV database to improve patch assessment accuracy, even when a new fix isn’t in the latest monthly update.

Vulnerability-specific checks are supported, allowing apps to confirm fixes for components such as NFC and Bluetooth before performing sensitive operations.