Google Enforces 24-Hour Delay for Android Sideloading to Block Malware

What Google Announced

Google has announced a new Android sideloading process that adds a mandatory 24 hour wait before users can install apps from unverified developers, a move the company says is meant to reduce malware installs, scam driven pressure, and risky account takeovers.

The change matters because sideloading has long been one of Android’s most flexible features.

It lets people install apps outside the Play Store, but it also gives attackers a way to trick users into installing harmful software. Google said the new approach is designed to keep that freedom while adding more safety checks for people who knowingly choose to take the risk.

Developer Verification

The company’s broader plan builds on a developer verification requirement announced last year. Under that policy, all Android apps must be registered by verified developers before they can be installed on certified Android devices.

Google said the goal is to identify bad actors faster and make it harder for them to spread malware.

That plan has drawn strong pushback. More than 50 app developers and marketplaces, including F-Droid, Brave, the Electronic Frontier Foundation, Proton, The Tor Project and Vivaldi, said the rules could create friction for smaller developers and raise privacy and surveillance concerns.

Their concerns include what personal information developers must hand over, how that data will be stored and protected, and whether it could be shared through government requests or legal processes.

The Advanced Flow

To address some of those worries, Google is introducing what it calls an advanced flow for power users who still want to sideload apps from unverified developers. Google said the process is a one time setup that includes several steps.

• Users must first enable developer mode in system settings.
• They then have to confirm they are acting of their own free will and are not being coached.
• After that, they must restart the phone and re authenticate so a scammer cannot quietly watch what they are doing.
• Only then do they wait through a 24 hour period before confirming the change with biometric authentication or a device PIN.
• Once the process is complete, they can install apps from unverified developers either indefinitely or for a seven day period.

Sameer Samat, Android Ecosystem President at Google, told Ars Technica that the delay is meant to make scams harder to pull off. “In that 24 hour period, we think it becomes much harder for attackers to persist their attack,” Samat said. He added that the waiting period could give victims time to realize something is wrong, saying that in that time someone may learn that a loved one is not really in jail or that a bank account is not under attack.

Google is also creating another option for smaller creators.

The company said it will offer free limited distribution accounts for hobbyist developers and students, allowing them to share apps with up to 20 devices without needing to provide a government issued ID or pay a registration fee.

Google said this is part of its effort to avoid a one size fits all approach for Android’s large and varied ecosystem.

What It Means for Users

There is one important exception.

Google said the new advanced flow will not apply to installs made through the Android Debug Bridge, better known as ADB.

The company also said limited distribution accounts and the advanced flow will be available in August 2026, before the broader developer verification requirements take effect the following month.

For everyday users, the message is simple. Google is not ending sideloading, but it is making the process slower and more deliberate when the developer is not verified. That extra friction is meant to help stop scams that depend on panic and urgency.

For people who regularly install apps outside official stores, the new rules may feel like a compromise. Google is preserving Android’s open nature, but it is also trying to make sure that openness does not become a shortcut for malware and fraud.

#Android #CyberSecurity #Malware #Google #MobileSecurity