SecurityStateManager

KEY_KERNEL_VERSION

static val KEY_KERNEL_VERSION: String

The kernel version key returned as part of the Bundle from getGlobalSecurityState.

Value: "kernel_version"

KEY_SYSTEM_SPL

static val KEY_SYSTEM_SPL: String

The system SPL key returned as part of the Bundle from getGlobalSecurityState.

Value: "system_spl"

KEY_SYSTEM_SUPPLEMENTAL_PATCHES

static val KEY_SYSTEM_SUPPLEMENTAL_PATCHES: String

The system supplemental patches key returned as part of the Bundle from getGlobalSecurityState.

The value is a String[] of CVE IDs (e.g., "CVE-2026-12345") that are affirmed to be fully mitigated in the system image, supplemental to the declared KEY_SYSTEM_SPL.

Value: "system_supplemental_security_patches"

KEY_VENDOR_SPL

static val KEY_VENDOR_SPL: String

The vendor SPL key returned as part of the Bundle from getGlobalSecurityState.

Value: "vendor_spl"

KEY_VENDOR_SUPPLEMENTAL_PATCHES

static val KEY_VENDOR_SUPPLEMENTAL_PATCHES: String

The vendor supplemental patches key returned as part of the Bundle from getGlobalSecurityState.

The value is a String[] listing CVEs (e.g., "CVE-2026-12345") that are affirmed to be fully mitigated in the vendor image, supplemental to the declared KEY_VENDOR_SPL.

Value: "vendor_supplemental_security_patches"

getGlobalSecurityState

open fun getGlobalSecurityState(): Bundle

Returns the current global security state. Each key-value pair is a mapping of a component of the global security state to its current version/SPL (security patch level). For example, the KEY_SYSTEM_SPL key will map to the SPL of the system as defined in android.os.Build.VERSION. The bundle will also include mappings from WebView packages and packages listed under config config_securityStatePackages to their respective versions as defined in android.content.pm.PackageInfo#versionName.

The bundle will also include lists of CVEs that are affirmed to be patched in the source code, supplemental to the declared Security Patch Level (SPL). These lists are associated with KEY_SYSTEM_SUPPLEMENTAL_PATCHES and KEY_VENDOR_SUPPLEMENTAL_PATCHES.

The presence of a CVE in these lists indicates that the device implementation has fully mitigated the vulnerability. The accuracy of this information is critical, as it is used to determine the device's security posture.