Sideloading: Android 13 significantly restricts third-party apps

It’s part of the freedom of the Android system, but it’s also a constant gateway to malware: sideloading apps. With Android 13, Google introduces new restrictions on third-party apps. In principle, they no longer have access to certain interfaces.

The accessibility trick is significantly limited with Android 13

The so-called Accessibility Services are intended to enable people with disabilities to use smartphones, for example by recognizing and reading content. However, Google has struggled with its accessibility APIs for years because its functions require very extensive access to sensitive content. The trick of malware like FluBot: once you get the user to allow this API, you can nest deep into the system. With Android 13, Google wants to put a new stop here.

The simple but far-reaching solution: If apps obtained outside of app stores, for example via websites or messaging services, have to be installed on the smartphone via APK, access to the Accessibility APIs is automatically denied. To reiterate here: Accessibility needs to be activated for every app, but Google seems to have enough data to suggest that overly careless users still activate and authorize apps from unknown sources.

if XDA Developer describes, the corresponding adjustments have been made in Android 13. If the option is selected here for apps from unknown sources, a message follows that reads “For your security, this setting is currently not available”. However, Google imposes a very important limitation here for operators of alternative app stores: third-party app stores use the so-called “session-based package installation API”, which is not restricted. Apps installed via messengers, mail clients, and browsers can no longer easily fool Android 13 users with the long-used accessibility tricks.