Cybersecurity
Android pKVM Earns SESIP Level 5 Certification – Implications for Mobile Hypervisor Security
Google’s protected KVM (pKVM) hypervisor for Android has achieved SESIP Level 5 certification, the highest security assurance for consumer‑electronics software. The certification, performed by Dekra under the TrustCB scheme, validates pKVM against ISO 15408 penetration testing and resistance to advanced attackers. Defenders should review hypervisor integrity controls and update deployment practices accordingly.
What Happened
Google announced that its protected KVM (pKVM), the core of the Android Virtualization Framework, has passed the Security Evaluation Standard for IoT Platforms (SESIP) Level 5 certification. The evaluation was conducted by Dekra, a recognized cybersecurity lab, under the TrustCB scheme compliant with EN‑17927.
Impact
pKVM is the first large‑scale consumer‑electronics hypervisor to meet this assurance bar, enabling Android to securely host high‑criticality isolated workloads such as on‑device AI and sensitive data processing. The certification demonstrates resistance to well‑resourced attackers with insider knowledge.
Technical Details
The SESIP Level 5 assessment incorporates AVA_VAN.5, the top tier of vulnerability analysis and penetration testing defined by ISO 15408 (Common Criteria). The evaluation covers hypervisor code integrity, memory isolation, and secure boot mechanisms, ensuring that pKVM can maintain isolation even under sophisticated threat scenarios.
What Defenders Should Do
- Verify that devices running Android 14 or later include the certified pKVM build and that the hypervisor version matches the certified release.
- Enable and monitor hypervisor integrity checks, ensuring that the kernel module signatures are validated at boot and during runtime.
- Review virtualization policies to enforce strict isolation boundaries for high‑criticality workloads, leveraging the certified isolation guarantees.
- Stay informed on future updates to the Android Virtualization Framework that may expand or modify the certified components.
Related articles
Mobile App Permissions Continue to Pose Security Risks for Organizations
Recent analysis shows that mobile apps still request excessive permissions, exposing devices to privacy and security threats. Defenders should audit permission requests, enforce least‑privilege policies, and monitor for anomalous usage. Implementing device‑policy controls and user education can mitigate risks.
Read briefing
Pegasus Zero‑Click Spyware: Detection and Mitigation for iOS and Android
Pegasus has been infecting mobile devices via zero‑click exploits, silently collecting messages, calls, location and audio. The threat remains active on both iOS and Android. Defenders should verify device integrity, monitor for abnormal data exfiltration, and apply vendor‑specific hardening steps.
Read briefing
Hirudo Android Malware Hijacks Banking Apps to Steal Credentials
Hirudo is an Android malware that replaces legitimate banking apps with malicious copies, disabling security checks to harvest credentials and remotely control devices. It targets banks in Indonesia, China, India, Mexico, Morocco, and Thailand, and is delivered via apps that masquerade as shopping or entertainment services. Defenders should verify app signatures, enforce Play Integrity, restrict Accessibility permissions, and deploy mobile security solutions to detect hooking engines.
Read briefing
Google Pixel 10 Exploits Earned $560,000 at Pwn2Own
At Pwn2Own Ireland 2026, three teams extracted more than $560,000 from Google Pixel 10 devices by chaining zero‑day and known flaws. The attacks demonstrate that even mainstream Android phones can be compromised via remote code execution. Defenders should prioritize patching, monitor for suspicious network activity, and enforce least‑privilege policies on mobile endpoints.
Read briefing