Threat Intelligence

Google Opens One-Tap Installs to Approved Third-Party Android Stores, but Not in the US

The Hacker News · 29 Oct 2026
Key Takeaway Decide now whether staff devices should be allowed to use third-party app stores, and use your device management tools to block registered stores where you do not want them.

Third-party Android app stores can now apply to Google for permission to install apps with one tap, skipping Android's usual confirmation screens, and to update apps in the background. To qualify, a store must pass identity checks and send Google its full catalog, plus every new app and update, for ongoing malware scanning. Approved stores get the features from December 1, but only on devices running Android 17 QPR2 or later in supported countries, which do not include the US.

Today, users must first allow a third-party store to install apps, then confirm each install and update. Under the new program, an approved store gets that permission automatically. Google's rules still require the store to get explicit user consent for each install, and it must not install apps silently. Large downloads and background installs must show a visible notification. Joining is optional, and stores that stay out will work as they do now.

Stores remain responsible for everything in their catalogs, and Google will not moderate their content. Extra fees apply if more than 1% of install attempts or more than 2% of a store's apps are found potentially harmful over 30 days. IT administrators can block registered stores on managed devices, though Google's pages do not say whether this also covers a store already installed. Google has also not described how apps are scanned, how fast new uploads are checked, or what the checks find.

Android App Stores Mobile Security Google Device Management

Summarised by CISO AI from The Hacker News, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.