Android Authority highlights an open-source fork of the popular Shizuku app that solves its most persistent problem — failing to stay active in the background and not restarting after a device reboot. Because Shizuku grants other apps access to restricted system APIs, its instability has long forced users to manually relaunch it, breaking tools like uninstallers and adaptive theme switchers. The fork, built by developers working from Shizuku's GitHub repository, adds automatic recovery so dependent apps keep working without manual intervention.
Google appears to be developing a way for users to customize which restrictions apply under Android's Advanced Protection mode, rather than enforcing all safeguards as a single bundle. This would let users opt into stronger security features selectively instead of accepting the full, more restrictive package.
Google has opened a formal beta program for its Drive app, letting users opt in to test upcoming features before they roll out broadly. The program follows similar early-access schemes Google runs for other apps like Gmail and Photos.
GrapheneOS has introduced a feature called Secure Paste that lets users paste text normally while preventing apps from silently reading clipboard content in the background. The feature aims to close a long-standing privacy gap where apps could monitor copied passwords, codes or personal data without user awareness.
A security researcher has published a series detailing how an unprivileged Android app can escalate to root access on major OEM devices using one repeatable strategy. The method targets manufacturer-specific kernel driver bugs—specifically page Use-After-Free flaws—reached via OEM-specific sandbox escapes, and was demonstrated on Samsung Galaxy S23 through S26 devices, many Xiaomi mid-range to flagship phones, and recent Oppo, OnePlus, and Realme flagships.
Google is now widely deploying Gemini as the default digital assistant across Android Auto, replacing the standard Google Assistant for drivers who haven't already switched manually. Users can still enable it themselves via Settings, and once active, Gemini handles voice interactions, messaging, music requests and more inside the car.
Several car manufacturers are planning to remove or reduce support for Apple CarPlay in vehicles starting in 2026, favoring proprietary infotainment systems instead. The shift is driven largely by electric vehicles, which need tighter software integration for functions like battery preconditioning and charging controls that CarPlay cannot manage as a simple phone-mirroring layer.
Google is highlighting that many persistent Android Auto connectivity problems stem not from the phone but from outdated software running on a car's infotainment system. The company recommends restarting the infotainment unit and, for aftermarket head units like Pioneer or Kenwood, checking the manufacturer's website for firmware updates.
Security researchers found that Android's public NAT-T socket-keepalive API allows ordinary apps to send UDP packets directly to a router, bypassing Always-on VPN and 'Block connections without VPN' protections. Tests on a Pixel 8 Pro, Samsung SM-F966B, and Nothing A059, all running Android 16, confirmed that keepalive packets reached the physical gateway outside the VPN tunnel, with one device sustaining a leak for over 24 hours. The root cause traces to changes in Android's startNattKeepaliveWithFd function, where validation checks tying the socket to the caller's VPN policy were added and later removed.
Security researchers found a flaw in Android's network stack that lets any app, without special permissions, send UDP packets through the device's Wi-Fi or cellular hardware that bypass VPN tunnels entirely. This occurs even when the 'Block all connections without VPN' setting is enabled, exposing a user's real IP address. The bug was reported through Google's Vulnerability Reward Program but closed without action, while GrapheneOS says it is working on a fix.
A solo developer running Google Ads for his puzzle app Dayzle discovered that of 56 billed installs over two weeks, only 13 were real users; the rest came from devices sideloading outdated app versions while falsely reporting Google Play as the installer. These fake installs showed zero engagement, spanned dozens of phone models across many states, and appeared to be generated by a bot farm gaming Google's install-based ad optimization.
Anthropic disclosed that between December 2025 and August 2026 it detected and disrupted misuse of its Claude AI models by multiple threat actors, including groups tied to ShinyHunters. One French-speaking member, 'frkoo', ran automated pipelines on AWS servers that downloaded 1.8 million Android APKs, decompiled them, and scanned for hardcoded credentials using TruffleHog, funneling verified findings into a categorized Telegram network. The same actor also harvested GitHub organization emails to obtain access tokens and ran a carding site impersonating French police to sell stolen payment data.
GoKawiil