AndroidX Security State can tell you if a CVE is patched on a device
Patch-level tracking across system, modules and kernel, with OSV data behind it.
The Security State libraries allow querying of specific high-risk vulnerabilities, so you can ask whether a given CVE has been patched on a device rather than inferring it from a patch date.
AndroidX Security State 1.1.0 and Security State Provider 1.0.0 have both been released. The libraries track patch levels across system, system modules and kernel components, and androidx.security.state.provider standardizes update availability reporting.
They integrate with the Open Source Vulnerabilities (OSV) database.
Separately, a new feature in Android 17 allows OEMs to declare specific security fixes via a Supplemental Patches XML file.
Sources
- Introducing the AndroidX Security State Libraries: A Unified View of Device Security Primary Android Developers Blog
Researched and drafted with AI assistance from the primary sources listed above, then checked against those sources before publication. Every factual claim here is traceable to a cited source; where the sources are silent, so are we. How this works.