SecurityPatchState

const val COMPONENT_KERNEL: String

Kernel component providing kernel version as VersionedSpl.

const val COMPONENT_SYSTEM: String

System component providing ro.build.version.security_patch property value as DateBasedSpl.

const val COMPONENT_SYSTEM_MODULES: String

System modules component providing DateBasedSpl of system modules patch level.

const val DEFAULT_VULNERABILITY_REPORTS_URL: String

URL for the Google-provided data of vulnerabilities from Android Security Bulletin.

const val UPDATE_INFO_SERVICE_BINDING_TIMEOUT_MS = 5000: Long

Timeout in milliseconds to wait for an IUpdateInfoService implementation to bind.

A 5-second timeout is standard for Android service binding to handle cases where the target service process hangs or fails to attach, preventing this API from suspending indefinitely.

fun getComponentSecurityPatchLevel(
    @SecurityPatchState.Component component: String,
    securityPatchLevel: String
): SecurityPatchState.SecurityPatchLevel

Retrieves the specific security patch level for a given component based on a security patch level string. This method determines the type of SecurityPatchLevel to construct based on the component type, interpreting the string as a date for date-based components or as a version number for versioned components.

@RequiresApi(value = 26)
fun getVulnerabilityReportUrl(
    serverUrl: Uri = Uri.parse(DEFAULT_VULNERABILITY_REPORTS_URL)
): Uri

Constructs a URL for fetching vulnerability reports based on the device's Android version.

val DEFAULT_SYSTEM_MODULES: List<String>

Default list of Android Mainline system modules.

SecurityPatchState(
    context: Context,
    systemModulePackageNames: List<String> = DEFAULT_SYSTEM_MODULES,
    customSecurityStateManagerCompat: SecurityStateManagerCompat? = null,
    vulnerabilityReportJsonString: String? = null
)

Creates an instance of SecurityPatchState.

fun areCvesPatched(cveList: List<String>): Boolean

Verifies if all specified CVEs have been patched in the system. This method aggregates the CVEs patched across specified system components and checks if the list includes all CVEs provided.

suspend fun fetchAvailableSecurityPatchLevel(
    @SecurityPatchState.Component component: String,
    timeoutMillis: Long = UPDATE_INFO_SERVICE_BINDING_TIMEOUT_MS
): SecurityPatchState.SecurityPatchLevel

Fetches the latest available security patch level for a specific component.

This is a convenience method that determines the effective security state by aggregating results from all trusted providers and comparing them against the device's current state.

Performance: This method performs IPC (Inter-Process Communication) to query trusted services. While the providers themselves may return cached data without triggering a network call, the service binding process is asynchronous and significantly heavier than local memory lookups.

Aggregation Logic: If multiple providers report updates for the same component (e.g., both an OEM updater and GOTA report a "SYSTEM" update), this method conservatively selects the newest (highest version/date) patch level among them.

Note: This value is based on the server-side state known to the update clients. It may not represent a real-time check if the update client has restricted background syncs (e.g., due to rate limiting or battery saver).

fun fetchAvailableSecurityPatchLevelAsync(
    @SecurityPatchState.Component component: String,
    timeoutMillis: Long = UPDATE_INFO_SERVICE_BINDING_TIMEOUT_MS
): ListenableFuture<SecurityPatchState.SecurityPatchLevel>

Fetches the latest available security patch level for a specific component.

This is the Java-friendly variant of fetchAvailableSecurityPatchLevel returning a ListenableFuture.

open fun getDeviceSecurityPatchLevel(
    @SecurityPatchState.Component component: String
): SecurityPatchState.SecurityPatchLevel

Retrieves the current security patch level for a specified component.

open fun getPatchedCves(
    @SecurityPatchState.Component component: String,
    spl: SecurityPatchState.SecurityPatchLevel
): Map<SecurityPatchState.Severity, Set<String>>

Lists all security fixes applied on the current device since the baseline Android release of the current system image, filtered for a specified component and patch level, categorized by severity.

open fun getPublishedSecurityPatchLevel(
    @SecurityPatchState.Component component: String
): List<SecurityPatchState.SecurityPatchLevel>

Retrieves the published security patch level for a specified component. This patch level is based on the most recent vulnerability reports, which is machine-readable data from Android and other security bulletins.

For System and System Modules (Mainline), this method employs a "Global Max" strategy: it returns the latest date found in the entire Vulnerability Report, regardless of whether that specific date included updates for the requested component. This ensures that the Published SPL aligns with the overall Android Security Bulletin date (e.g. 2026-01-05), preventing stale reporting during months where the Bulletin may only list patches for other components (e.g. Vendor-only updates) or is advisory-only under Risk Based Update System (RBUS) policies.

For Kernel and Vendor components, it returns the latest patch level specifically associated with those components in the report.

fun isDeviceFullyUpdated(): Boolean

Checks if all components of the device have their security patch levels up to date with the published security patch levels. This method compares the device's current security patch level against the latest published levels for each component.

@WorkerThread
fun loadVulnerabilityReport(jsonString: String): Unit

Parses a JSON string to extract vulnerability report data. This method validates the format of the input JSON and constructs a VulnerabilityReport object, preparing the class to provide published and available security state information.

suspend fun queryAllAvailableUpdates(
    timeoutMillis: Long = UPDATE_INFO_SERVICE_BINDING_TIMEOUT_MS
): List<UpdateCheckResult>

Queries for available security updates from all trusted update providers.

This method performs a comprehensive check by:

1. Discovering all trusted services on the device that implement the UpdateInfoService protocol (e.g., System Updater, Google Play Store).

2. Querying each service concurrently to retrieve its status.

3. Collecting the results into a list.

Freshness & Caching: The freshness of the returned data depends on the internal policies of the individual update providers. Providers are expected to maintain a reasonably fresh cache (typically refreshing at least once per hour). If a provider determines its cache is stale, this call may suspend while it performs a network fetch.

fun queryAllAvailableUpdatesAsync(
    timeoutMillis: Long = UPDATE_INFO_SERVICE_BINDING_TIMEOUT_MS
): ListenableFuture<List<UpdateCheckResult>>

Queries for available security updates from all trusted update providers.

This is the Java-friendly variant of queryAllAvailableUpdates returning a ListenableFuture.