Google is finally seeing tangible results after dedicating itself to improving Android's security in the past few years.
According to new statistics the company released today, percentage-wise devices running newer Android versions have been infected in much fewer numbers than devices running older OS releases.
For example, the percentage of Android devices that contain at least one potentially harmful application (PHA) --the term Google uses for Android malware-- is above the 0.5 percent figure for Android devices running KitKat (4.x), Lollipop (5.x), and Marshmallow (6.x), but it's way smaller for newer OS versions.
Google reports that 0.25 percent of all Android Nougat (7.x) devices contain at least one PHA, while the percentage for Oreo (8.x) and Pie (9.x) is even smaller, with 0.14 percent and 0.06 percent, respectively.
"We attribute this to many factors, such as continued platform and API hardening, ongoing security updates and app security and developer training to reduce apps' access to sensitive data," said the Android Security & Privacy Team in a blog post today.
"In particular, newer Android versions--such as Nougat, Oreo, and Pie--are more resilient to privilege escalation attacks that had previously allowed PHAs to gain persistence on devices and protect themselves against removal attempts."
But even in the case when users are running older Android versions, they can still be safe. The trick, according to Google, is users restrict themselves to installing apps only made available through the official Play Store.
Google says that users who installed apps only from the Play Store have been infected by PHAs in much fewer numbers compared to the percentage of users who also installed apps from unofficial third-party stores or other locations -through a process called side-loading.
Google says that the PHA infection rate for "Google Play only" users is 0.09 percent, while the same figure is 0.61 percent for users who also sideloaded apps.
Sure, the Play Store isn't perfect and you can still install a malicious app once in a while, but Google says that "Android devices that only download apps from Google Play are 9 times less likely to get a PHA than devices that download apps from other sources."
As for where most of the infected users are located, the top countries are Indonesia, India, the US, Russia, and Japan. The good news is that as Google rolled out new Android versions in recent years, a visible downward trend has been observed in infection numbers compared to the previous years.
The Android OS maker promised more detailed stats and a deeper dive into the Android ecosystem in the 2018 Android Security Year in Review, a yearly report that's scheduled for release in the first quarter of 2019.
In the meantime, Google published "Android Enterprise Security," a white paper detailing the new enterprise-centric security features that have been added to Android after Pie's release in August.