Google is Expanding its Scanning of Sideloaded Android Apps with Play Protect

Google Play Protect checks for malicious sideloaded apps at install time on Android, but Google is going to expand this feature to include an enhanced real-time scanning option.

“We are making Google Play Protect’s security capabilities even more powerful with real-time scanning at the code level to combat novel malicious apps,” Google’s Steve Kafka and Roman Kirillov write in the announcement post. “Google Play Protect will now recommend a real-time app scan when installing apps that have never been scanned before to help detect emerging threats.”

Google Play Protect is enabled on all Android devices running Google Play Services and the firm says that it scans over 125 billion apps every day to protect users from malware and harmful apps. And it works outside of Google Play, too: If a user side-loads an app—that, installs one outside of the Google Play Store—Play Protect performs a real-time check, using on-device machine learning to detect threats. It also scans the device for harmful apps regardless of their install source or the device’s online availability.

Today’s announcement signals an expansion of these features. Now, Google Play Protect will use the cloud-hosted Play Protect infrastructure to evaluate side-loaded apps at the code level. “This enhancement will help better protect users against malicious polymorphic apps that leverage various methods, such as AI, to be altered to avoid detection,” Google explains.

This new Google Play Protect feature has already started rolling to all Android devices with Google Play services in select countries, starting with India. It will expand to all regions in the coming months, Google says.