How Android 17 Hardens Network Security with ECH and 2G Controls

Android 17 (API level 37) introduces four major network security improvements: platform support for Encrypted Client Hello (ECH) to hide the names of visited domains, mandatory local network access control, enabling Certificate Transparency by default, and the ability for mobile operators to turn off 2G without user involvement. The updates affect all apps targeting API 37 and above and are aimed at closing specific attack vectors — from interception of TLS connection metadata to forced downgrades of mobile connectivity to the vulnerable 2G standard. The Google announcement was published on August 27, 2026.

Encrypted Client Hello: OS-level server name encryption

ECH is a TLS extension that encrypts the Server Name Indication (SNI) field in the initial handshake. Before ECH, even when using HTTPS, a network observer could see which domain a user was connecting to, because SNI was sent in plaintext. Now Android 17 provides ECH support at the platform level, not just in individual browsers.

Key technical aspects of the implementation:

• ECH is enabled by default for apps targeting Android 17 and higher, but the protection actually works only when two conditions are met simultaneously: the app’s networking library supports ECH, and the target server publishes a compatible configuration via HTTPS DNS records.
• For servers that do not support ECH, the platform automatically applies ECH GREASE — sending random dummy ECH extensions so that all connections look uniform and it is impossible to distinguish protected ones from unprotected ones.
• ECH works in tandem with Private DNS (DNS-over-TLS/HTTPS), hiding domain names both at the DNS resolution stage and during the TLS handshake. The destination IP address remains visible — ECH is not a replacement for a VPN.

Previously, ECH was available in Chrome and Firefox at the browser level. Mozilla announced its ECH rollout in October 2023. Integration into Android 17 extends this protection to the entire operating system, including third-party apps. The OkHttp 5.5.0 library already documents ECH support in opt-in mode, allowing developers to add this protection to their apps without writing their own TLS code.

Local network protection: explicit consent instead of silent access

Local Network Protection becomes mandatory for apps targeting API 37. Traffic to devices on the local network — TCP connections, UDP packets (unicast, multicast, broadcast), including requests via Cronet and OkHttp — is blocked by default. An app must either use the system device picker (privacy-preserving picker) or request the ACCESS_LOCAL_NETWORK permission from the user.

For apps targeting SDK 36 and below, there is a transition period: they continue to receive implicit local network access via the INTERNET permission. The enforced restriction takes effect only when the target SDK is updated to 37.

This measure closes a scenario in which an app could silently scan the local network, discover IoT devices, printers, NAS storage, and use the collected information to profile the user’s home network or move laterally.

Certificate Transparency and 2G management

Android 17 enables Certificate Transparency by default for app connections. CT requires certificates to be logged in public logs, which makes it possible to detect mistakenly or maliciously issued certificates. Apps can, if necessary, disable CT globally or for specific domains via the network security configuration.

A separate focus area is protection against cellular downgrade attacks. Google describes the threat of rogue base stations (SMS blasters) that forcibly switch devices from LTE/5G to 2G, where traffic interception and phishing SMS campaigns become possible. The evolution of protection against this threat on Android:

1. Android 12 — manual option to disable 2G at the hardware level (device-dependent).
2. Android 14 — enterprise policies that allow IT administrators to disable 2G on managed devices.
3. Android 17 — mobile operators can configure 2G to be disabled by default for their subscribers without any action required from the user.

The availability of this latest feature depends on the participation of a particular operator — it is not a universal automatic 2G shutdown for all Android 17 devices.

Practical recommendations

• For app developers: when updating your target SDK to 37, check compatibility with Local Network Protection. If your app interacts with local devices, add a request for ACCESS_LOCAL_NETWORK or switch to the system device picker. To benefit from ECH protection, use OkHttp 5.5.0 or the platform TLS stack.
• For mobile operators: assess the possibility of enabling 2G shutdown by default for your subscriber base — this removes the SMS blaster attack surface without the need to train users.
• For end users: enable Private DNS in Android settings (DNS-over-TLS or DNS-over-HTTPS) — without it, ECH loses much of its effectiveness because domain names remain visible at the DNS resolution stage. On devices running Android 12–16, manually disable 2G in network settings if your operator has not done so automatically.
• For corporate device administrators: use Android Enterprise policies to forcibly disable 2G across your managed fleet without waiting for an upgrade to Android 17.

Android 17 establishes a multi-layered model of network protection: ECH closes off TLS metadata leakage, Local Network Protection restricts reconnaissance on the local network, CT increases trust in certificates, and 2G management removes an outdated cellular attack vector. For ECH to be maximally effective, you must enable Private DNS and ensure the apps you use rely on compatible networking libraries — without these conditions, SNI encryption will not be engaged.