--- title: "Release Notes Mobile Application Shielding for Android Version 9.2.0 (October 2026)" slug: "oapps-release-notes-app-shielding-for-android-9-2-0" updated: 2026-10-21T15:43:29Z published: 2026-10-21T15:43:29Z canonical: "docs.onespan.com/oapps-release-notes-app-shielding-for-android-9-2-0" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.onespan.com/llms.txt > Use this file to discover all available pages before exploring further. # Release Notes Mobile Application Shielding for Android Version 9.2.0 (October 2026) ## Introduction Welcome to Mobile Application Shielding for Android 9.2.0! This is a release of Mobile Application Shielding, which contains enhancements and other product updates. It also contains a compatibility release (App Shielding for Android 9.2.0-SDKcompat) to support compatibility with third party SDKs (e.g., payment SDKs). Except for the compatibility feature, there are no differences between App Shielding for Android 9.2.0-SDKcompat and App Shielding for Android 9.2.0. Thus, no separate set of documents has been provided for the compat release. For more information about new features and fixed defects, refer to the respective sections in this article. For information about configuring and using Mobile Application Shielding, see the [Mobile Application Shielding Integration Guide](/oapps/docs/oapps-integration-guide-920-815). ## Upgrade Strategy Version 9.2.0 is a Feature release. If you are already using a Feature version (e.g., 9.1.1), upgrade to this version. If your goal is to maintain predictable stability, stay on the Stable track (e.g., 9.0.1). Do not upgrade to this version unless you specifically need one of the new features described below. ## Security Notice This release builds on App Shielding for Android hardening. Upgrading to this version and re-shielding your app enables code-injection detection automatically, with no configuration needed. A small number of additional protections require an explicit configuration step. Review the following: - Code injection detection has been improved, the Code Injection configuration option is now enabled by default. No configuration change is required. - The binding best practices further strengthen App Shielding protection. For information about the recommended configuration, see [Best practices](/oapps/docs/oapps-iga-binding-rules-9-2-0#best-practices). - [Applicable to Premium Features only] For Code Obfuscation licenses, the protection against memory dump attacks added in Jigsaw v2.1.1 applies when both Section Encryption and Control Flow Obfuscation are enabled. Enable both in your Code Obfuscation configuration. For more information, refer to the latest versions of the [OneSpan Code Obfuscation documentation](/oapps/docs/onespan-code-obfuscation). ## Supported versions ### App Shielding Over the next months, support for a number of Mobile Application Shielding versions will expire on the [OneSpan Mobile Portal](https://mobile.onespan.com/). For more information, see [Unsupported versions of Mobile Application Shielding Online](/oapps/docs/omp-unsupported-versions-online-oapps). ### Android - App Shielding version 9.2.0 was successfully tested with Android 17. - Android 5.0 (API level 21) – Android 17 (API level 37). - Shielding Tool: - Windows 10: 64-bit Java 17 - Mac OSX (10.9+) - Ubuntu Linux 22.04 LTS or 24.04 LTS #### Android platform updates The Android minimum supported version is 5.0 (API level 21). This version of App Shielding supports Android 17. > If you want your protected app to run on Android 15 or later, you must upgrade to App Shielding 6.6.0 or later. Beginning with Android 15, Android supports devices that are configured to use a page size of 16 KB (i.e., 16 KB devices). App Shielding has been updated to work on these 16 KB devices. However, if your app uses any native libraries, you must ensure that these libraries are ready for 16 KB page sizes. For more information, refer to the [Android Developer documentation](https://developer.android.com/guide/practices/page-sizes). ## Changes and Deprecations ### System screen readers by default trusted Screen readers that are installed as system apps are now trusted by default when the Check trusted Screen Readers configuration option is enabled, without requiring entering the certificate hash of a trusted screen reader’s signature. To restore the previous behavior, deselect the Enable check box for Check trusted Screen Readers and specify the list of known trustworthy screen readers. ## New features and other updates ### Automatically trust system accessories New configuration options are now available to explicitly trust system accessories: Trusted System Keyboards and Trusted System Screen Readers. This makes it possible to automatically trust system-installed keyboards and screen readers, when the Check trusted keyobards and Check trusted Screen Readers options, respectively, are enabled. By default, both new options are enabled. > If either is disabled, system-installed keyboards or screen readers must match a signature in Trusted keyboards and Trusted Screen Readers, respectively, like any third-party accessory. ### [Applicable to Premium Features only] Jigsaw engine upgrade For Code Obfuscation licenses, the Jigsaw engine has been upgraded to v2.1.1, which adds protection against memory dump attacks when both Section Encryption and Control Flow Abstraction are enabled. ## Fixes and other changes SHAND-5573: Improved code injection detection **Description**: Code injection detection has been improved and now detects Vulkan layer injection, where a malicious Vulkan layer is used to inject code into the app. SHAND-5926: Improved hooking framework detection **Description**: Hooking framework detection has been improved to detect the Frida injection loader. SHAND-5927: Incorrect Kotlin dependency **Description**: An incorrect Kotlin dependency in the relevant Maven dependency resulted in a Module was compiled with an incompatible version of Kotlin error. **Status**: This issue has been fixed. SHAND-6018: Improved emulator detection **Description**: Emulator detection has been improved to detect Linux container-based emulators such as VMOS. SHAND-6030: Protected apps hang **Description**: On certain devices, protected apps sometimes would hang at launch. **Status**: This issue has been fixed. SHAND-6072: Improved checking of trusted keyboards **Description**: Checking trusted keyboards has been improved to continue trusting a system installed keyboard after it has been updated. SHAND-6084: Activity Guard issue **Description**: An issue with Activity Guard sometimes caused the app's splash screen to flicker or briefly disappear during launch on Android 12 and above. **Status**: This issue has been fixed. INT-552: Binding style maximum limits applied globally **Description**: An issue caused binding style maximum limits to be applied globally instead of per method or class. **Status**: This issue has been fixed. [Applicable to Premium Features only] Jigsaw engine upgrade For OneSpan Code Obfuscation licenses, the Jigsaw engine has been upgraded to v2.1.1, which includes the following improvements: - Improved the obfuscation of the decryption logic for Section Encryption. - Improved the security of Control Flow Abstraction for ARM by making it harder to exfiltrate its data. - Removed internal temporary file paths from the Shielding Tool log output. - Failure to generate a protection report no longer halts the protection process. - Fixed an issue with Section Encryption not preserving utilized registers. - Fixed a potential runtime issue that could occur with Section Encryption executing stale instructions on arm64 binaries. - Fixed a protection settings failure when `integrityCheck` was specified without a `rules` array. - Fixed an overlapping blocks disassembly failure for arm32 and x86_64 Flutter binaries. - Fixed a non-string panic payload error that could appear when an internal failure occurred during protection. ## Other Notices Virtual space apps restricted Some virtual space apps use techniques similar to malware (e.g., native code hooking), which can trigger App Shielding security protections. As the App Shielding detection capabilities improve, additional virtual space apps might be restricted. ## Known limitations The limitations described here have not yet been solved for the current Mobile Application Shielding version. Possible workarounds are described where available. Unsupported Android 17 feature App Shielding supports Android 17 but not its new post-quantum cryptography features, including ML-DSA keystore keys and v3.2 APK signature schemes. Using these features will result in a repackaging detection. Use classical keys and existing signature schemes for now. Support for these features will be added in a future release of a future release of App Shielding for Android. Exit on emulator URL not triggered reliably For some configuration options, App Shielding can launch a web page that displays an explanation if a given condition is met and the application is shut down. To launch such a web page, the URL is added to the configuration. For the Exit on emulator URL option, i.e. to launch a web page when the application is shut down because the app is run in an emulator, the URL is not being reliably triggered. There is no guarantee that the web page is launched even though the application may be running in an emulator. We therefore recommended to not using this option. For general information about launching a web page with an explanation, see [Exit URL launching on Android](/oapps/docs/oapps-iga-exit-url-launching-on-android-9-2-0). Build failures for Java/Kotlin sample To resolve build failures of the Java/Kotlin sample app, edit the CMakeLists.txt file located in the cpp folder. Replace `target_compile_features(native-lib PRIVATE cxx_std_17)` with the following two lines: ```plaintext set(CMAKE_CXX_STANDARD 11)            set(CMAKE_CXX_STANDARD_REQUIRED ON) ``` With this change, the sample should build successfully. Methods to block screenshots also block screen mirroring tools Description: The methods used to block screenshots also block some screen mirroring tools. However, the scrcpy tool is only blocked on Android 12 and later. On Android 15, this option also blocks partial screen sharing. Bypassing App Shielding protection in Cordova-based applications Description: Because of the nature of pure Javascript frameworks such as Cordova, the effectiveness of the push and pull bindings of App Shielding is affected. As a result, it might be possible to extract all Javascript files from a shielded application and build a new Cordova-based application with the extracted Javascript files. That new application will behave identical to the original one but has two major differences: 1. It is no longer protected with App Shielding. 2. It is signed with a different developer certificate. Because this new application is signed with a different developer certificate, it is recognized by the stores or every device as a completely different and new application in comparison to the original shielded application. It cannot be avoided that a new application like this is built that looks and behaves similar to the original application. OneSpan risk assessment: Threat actors will need to make heavy use of targeted phishing attacks to convince users of the original application to install the rogue version. For attackers, however, it is much easier to use existing malware frameworks that mimic hundreds of login screens in one single piece of malware. In addition, the existence of any rogue versions of the application does not affect the security features of the original shielded application. Everyone who is using the genuine, shielded application is protected with all the features of App Shielding, including all security measures of the original application. Therefore, we consider this issue to be of low risk. NFC payment failure in shielded apps with Thales Gemalto SDK Description: When using the shielded version of the app, NFC payments fail. This is caused by a compatibility issue with the Thales Gemalto TSH Pay SDK which also provides debugger detection. The SDK incorrectly flags the App Shielding debugger detection as a native debugger. Solution: Allowlisting. For implementations integrating both the Thales Gemalto SDK and App Shielding, debuggers coming from the SDK's own debugging processes and sub-processes should be added to an allowlist within the Thales Gemalto SDK. > It is essential to not only add the processes to the allowlist but also their sub-processes. Otherwise, the SDK will still handle App Shielding as a native debugger! Magisk and root hider tools on new Android versions Root hider tools such as Magisk Hide are designed to hide the fact that the device is compromised (rooted). Android has been increasingly restricted in what can be inspected and observed of the system from inside an app. This means that a rooted system with a root hider tool can be hard to detect due to missing privileges. On Android 8+, App Shielding may not able to reliably detect a rooted device with Magisk Hide depending on the version of these tools.