Android 17 Closes Accessibility API Loophole Exploited by Stalkerware

Android 17 restricts accessibility service access to explicitly authorized apps, blocking a vector long abused for stalkerware and overlay-based credential theft. Google announced the tightening in its May 2026 Android security overview as part of expanded core advanced protections. The change affects any app using accessibility hooks without proper authorization and is a breaking change for custom enterprise tooling relying on that pathway. Organizations should audit dependencies before Android 17 rolls to their fleets.