Ethical Hacking News
Google has announced that it will allow third-party Android app stores to install apps with one tap, without the need for Android's usual confirmation screens, and to update them in the background, on devices running Android 17 QPR2 or later, in supported countries. This new program aims to promote security and user trust while providing a more convenient experience for users.
Google is expanding its Registered App Stores program to allow third-party stores to install apps with one tap on devices running Android 17 QPR2 or later.Approved stores must meet certain requirements, including passing identity checks, sending Google their full catalog, and undergoing malware scanning.The new program is expected to improve user experience and security, and is optional for stores that choose not to participate.Stores must obtain user consent for each install and cannot install apps silently without user consent.IT administrators can block registered stores from being installed on managed devices.The program requires stores to pay a $10,000 yearly fee and adhere to specific security and verification requirements.
Google has recently announced its intentions to expand its Registered App Stores program, which previously offered a limited number of approved stores to install third-party apps with one-tap installs on devices running Android 17 QPR2 or later. In a move that is expected to bring more convenience and flexibility to users outside the United States, Google has announced that it will allow third-party Android app stores to install apps with one tap, without the need for Android's usual confirmation screens, and to update them in the background.
To qualify for this new program, third-party stores must meet a set of requirements, which include passing identity checks and sending Google its full catalog, along with every new app and update, for ongoing malware scanning. Approved stores will get the features from December 1, but only on devices running Android 17 QPR2 or later in supported countries, which do not include the US. The new program is expected to bring significant improvements in terms of user experience and security, as users will no longer need to manually confirm each install and update.
The Registered App Stores program was announced in March, alongside changes that Google said resolved its disputes with Epic Games. The new program is designed to promote security and user trust, while also providing a more convenient experience for users. The program is optional, and stores that choose not to participate will continue to operate as they do today.
Under the terms of the new program, the store must still get the user's explicit consent for each install and "must not install apps silently without user consent." Large downloads and background installs must show a visible notification while they run. If an install is started on another device, the store must show a notification that does not close automatically.
IT administrators can block registered stores from being installed on managed devices. Google's program pages do not say whether the block also applies to a store that is already installed. The program also requires stores to meet a set of additional requirements, including being registered as an organization and keeping their developer identity verified under Android developer verification.
Beyond the catalog scanning, Google's requirements say a store must: send every version of its own app to Google for malware screening, exactly matching the version it publishes on the web and through other channels, work to keep malware and other potentially harmful apps out of its catalog, fix major security flaws that come to its attention, not block other app stores from being installed, interfere with them, or hide or change Android's security notifications, pay a $10,000 yearly fee, due before Google starts its review.
Each store stays responsible and liable for everything in its catalog. Google will not moderate the content in registered stores. If more than 1% of install attempts or more than 2% of a store's apps are found to be potentially harmful over a 30-day period, Google charges additional fees to screen and clean up the catalog.
A store that fails to meet any requirement, including paying on time, can be removed from the program until the issue is resolved. Google gives notice and a chance to fix it first. Google's program pages do not describe how submitted apps are scanned, how quickly new uploads are checked, or what results the checks produce.
Registered stores also get a Google tool, the Android Developer ID API, to check whether each app in their catalog comes from a verified developer and can be installed. Google recommends that stores block installs of apps that fail the check. Android developer verification is a separate Google program, now in its first phase with seven app stores.
Since September 30, certified Android devices in Brazil, Indonesia, Singapore, and Thailand have checked that apps from those stores come from verified developers, according to Google. Google plans to extend the checks worldwide in 2027. Availability follows each user's home country. Short trips to unsupported countries do not turn off one-tap installs or automatic updates.
Android 17 QPR2 is one of Android's quarterly platform releases (QPRs). Its latest version, released October 16, is still a beta, and Google's release notes give no date for the final release. In the US, a separate Google program for distributing third-party stores through Google Play has been in effect since July 22.
Related Information:
https://www.ethicalhackingnews.com/articles/Google-Grants-Approval-to-Third-Party-Android-App-Stores-to-Install-Apps-with-One-Tap-Installs-Outside-the-US-ehn.shtml
https://thehackernews.com/2026/10/google-to-allow-one-tap-android-app.html
Published: Wed Oct 28 13:44:04 2026 by llama3.2 3B Q4_K_M
