Google has launched the Android Partner Vulnerability Initiative (APVI), a new program specifically designed to deal with security vulnerabilities the company finds in third-party Android devices and software serviced by Android OEMs.
This program adds to Google’s other initiatives surrounding its efforts to discover and address Android security issues with the help of security researchers and the Android community including the Android Security Rewards Program (ASR) (for Android system) and the Google Play Security Rewards Program (for third-party apps).
Issues affecting the Android Open Source Project (AOSP) impact all Android devices and are disclosed through ASR reports released via Android Security Bulletins (ASB) each month.
However, vulnerabilities Google discovers outside of the Android Open Source Project (AOSP) based code that only affect a small subset of Android OEM devices weren’t previously disclosed via a public program.
The APVI initiative fixes this and improves overall Android OEM device security by letting users know when Google finds security bugs in Android device code that is not serviced or maintained by Google.
Commenting on the initiative, Kylie McRoberts, Program Manager and Alec Guertin, Security Engineer explained:
Google’s Android Security & Privacy team has launched the Android Partner Vulnerability Initiative (APVI) to manage security issues specific to Android OEMs. The APVI is designed to drive remediation and provide transparency to users about issues we have discovered at Google that affect device models shipped by Android partners.
The APVI covers Google-discovered issues that could potentially affect the security posture of an Android device or its user and is aligned to ISO/IEC 29147:2018 Information technology — Security techniques — Vulnerability disclosure recommendations. The initiative covers a wide range of issues impacting device code that is not serviced or maintained by Google (these are handled by the Android Security Bulletins).
The APVI has already processed a number of security issues, improving user protection against permissions bypasses, execution of code in the kernel, credential leaks and generation of unencrypted backups
Google provided several examples of vulnerabilities .previously discovered in Android OEM devices including a permission bypass issue impacting a third-party pre-installed over-the-air (OTA) update tool, credential leaking via the built-in password manager of a popular pre-installed web browser, and unnecessary permissions access for privileged apps.
