Google adds “24‑hour wait” for sideloading Android apps

Google has announced new security measures for Android sideloading, introducing a mandatory 24-hour waiting period for installing apps from unverified developers. The new “advanced process” aims to reduce malware and scamswhile keeping Android open.

The changes come as a follow-up to mandatory developer verification that Google announced in 2025. Under the new policy, all Android apps must be registered by verified developers in order to be installed on certified devices. The move is intended to help detect malicious actors more quickly and prevent malware from being distributed.

See also: Google calls Android's new sideloading 'high-friction'

The registration requirements have sparked strong backlash from over 50 app developers and marketplaces, including F-Droid, Brave, the Electronic Frontier Foundation, Proton, the Tor Project , and Vivaldi. Critics argue that the measures create friction and barriers to entry, while raising concerns about privacy and surveillance.

Google: New Advanced Android Sideloading Process

To address accessibility concerns, Google developed an advanced process that allows experienced users to retain the ability to install apps from unverified developers. The process involves five critical steps:

• First, users need to enable developer mode in the system settings .

• Second, they must confirm that they are proceeding with this step of their own volition and are not being guided by third parties.

• Third, a phone restart and re-authentication to prevent fraudsters from tracking their actions.

• The fourth and most critical step is the 24-hour waiting period , during which users must confirm that they really want to make this change via biometric authentication or device PIN

• Finally, they can install apps from unverified developers after understanding the risks.

See also: Google brings Android desktop mode to Pixel devices

Sameer Samat, President of the Android Ecosystem, explained the logic behind the 24-hour wait: “During this 24-hour period, we believe it becomes much more difficult for attackers to sustain their attack. In that time, you can likely learn that your loved one is not actually being held in jail or that your bank account is not actually under attack.”

The problem has become serious, as according to Kaspersky, Android malware increased significantly in the first half of 2025. In the second quarter of 2025 alone, thousands of malicious APK files, including many banking Trojans. Apps installed via sideloading contain over 50 times more malware than those on the Play Store.

The new process includes multiple security steps designed to prevent cybercriminals from deceiving users. Specifically, criminals often trick unsuspecting users who sideload such apps into granting elevated permissions that allow them to disable Play Protect, the built-in malware protection feature.

Google announced plans to offer free “ limited distribution accounts ” that allow amateur developers and students to share apps with up to 20 devices without having to provide government ID or pay a $25 registration fee .

See also: BeatBanker: Android malware mimics Starlink app to compromise devices

It's worth noting that the aforementioned process does not apply to installations via the Android Debug Bridge (ADB). Limited distribution accounts for students and hobbyists, as well as advanced flow for users, will be available in August 2026 (before the new developer verification requirements go into effect next month).

“We know that a ‘one size fits all’ approach doesn’t work for our diverse ecosystem,” Google said. “We want to ensure that identity verification isn’t a barrier to entry, so we provide different paths that fit your specific needs.”