Google is introducing new network security protections in Android 17 to strengthen connection privacy, address cellular vulnerabilities, and protect the privacy of users’ home networks.
Android 17 adds support for Encrypted Client Hello (ECH), a new privacy standard that operates in conjunction with private DNS to hide profiling metadata, including visited domain names.
ECH acts as a privacy extension for TLS, the protocol that secures HTTPS connections, encrypting the opening part of the TLS handshake that reveals the contacted hostname via the Server Name Indication (SNI).
Even if the connection to a website or service is secure, internet service providers (ISPs) and Wi-Fi operators can still see the destination, which can be collected for commercial profiling purposes.
Android users benefit from ECH when browsing with Chrome 117 and later or Firefox 119 and later, but Android 17 incorporates the protection at the platform level.
“This new privacy standard works in tandem with private DNS to obscure the domain names you visit, hiding metadata that can be used to profile you,” reads Google’s announcement.
“By encrypting the destination website name from the very start, ECH helps ensure that, for supported websites and apps, network providers and network snoopers can no longer easily see which websites or apps you are accessing.”
ECH will be enabled by default for apps targeting Android 17, provided they use a compatible networking library, such as the latest versions of OkHttp, WebView, or HttpEngine.
Source: Google
Google explains that, on servers that support ECH, Android will now encrypt the hostname.
On servers that don’t support the protection system, Android will send a fake ECH-looking field, called ECH GREASE, so real ECH connections don’t stand out, though the hostname is still visible.
Jigsaw, Google’s internet privacy and anti-censorship technology unit, tested ECH GREASE against the top 10,000 domains and across 740 internet providers in 202 countries, finding no site-loading issues or unexpected network blocks.
WiFi protections and 2G blocks
Beyond rolling out broader support for ECH on Android, Google also announced a few more important network protections that improve user security and privacy through their combined use.
The first is adjustments to Local Network Protection that now require apps to obtain permission before scanning for or connecting to devices on the user’s local network.
The second is that Android 17 now enables Certificate Transparency by default, requiring website certificates to appear in public logs, hence making the use of forged certificates more evident.
Google also announced that participating mobile operators will now be able to turn off 2G automatically for subscribers, reducing their exposure to SMS blasters and rogue base stations that can deliver malicious messages or capture sensitive traffic from nearby devices.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.