Skip to content

MASTG-BEST-0010: Use Up-to-Date minSdkVersion

Content in BETA

This content is in beta and still under active development, so it is subject to change any time (e.g. structure, IDs, content, URLs, etc.).

Send Feedback

Ensure that the minSdkVersion in the build.gradle file is set to the latest version of the Android platform that aligns with your app's requirements while maintaining compatibility with your user base.

Companies often hesitate to increase minSdkVersion because they want their app to be available on as many devices as possible. Even though Google doesn't enforce a specific minSdkVersion, as they do with the targetSdkVersion, it's crucial to understand the implications of setting a low minSdkVersion, as it directly impacts security, exposes users to vulnerabilities, and prevents the app from leveraging critical security protections.

Clarifying the Difference: targetSdkVersion vs minSdkVersion

  • targetSdkVersion: Defines the highest API level the app is designed to run on. The app can run on lower API levels, but it won't necessarily take advantage of all new security enforcements.
  • minSdkVersion: Defines the lowest API level the app is allowed to run on. This is crucial because many security features are only available on devices running a certain API level or higher. If you set a low minSdkVersion, your app completely misses out on these protections on older devices.

Even if you set a high targetSdkVersion, the app can still run on older devices without the latest security improvements. If you set targetSdkVersion=33 (Android 13) but minSdkVersion=21 (Android 5), the app can still be installed on Android 5 devices, which lack years of critical security updates. Malware on these older devices can exploit missing security features that app-level code alone cannot address, as evidenced by vulnerabilities listed in the Android Security Bulletins.

While increasing minSdkVersion may slightly reduce the number of devices your app can run on, it significantly enhances security by ensuring that all users have a baseline level of protection.

Common Misconceptions

There are many misconceptions about the minSdkVersion and targetSdkVersion in Android development. The Android documentation sometimes mentions "targeting" when they actually mean "running on." For example:

Opt out of cleartext traffic: The guidance in this section applies only to apps that target Android 8.1 (API level 27) or lower. Starting with Android 9 (API level 28), cleartext support is disabled by default.

The note says the guidance applies to apps targeting API 27 or lower. But in reality, even if an app targets API 28+ but is running on an older Android version (below API 28), cleartext traffic is still allowed unless explicitly disabled. Developers might assume that just increasing targetSdkVersion automatically blocks cleartext, which is incorrect.

Notable Android Platform Security Improvements Over Time

Tests

MASTG-TEST-0x33: References to Local File Access in WebViews MASTG-TEST-0253: Runtime Use of Local File Access APIs in WebViews