Android SDK 36.1

Last reviewed Oct 24, 2026

Export as PDF

Prompt Details

Prompt Composition

2prompts
  1. Kotlin 2.4116 lines · 3.7K tokens
  2. Android SDK 36.159 lines · 3.1K tokens
Total175 lines · 6.8K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 78
  • 79
  • 88
  • 89
  • 94
  • 117
  • 201
  • 208
  • 209
  • 212
  • 250
  • 287
  • 295
  • 297
  • 307
  • 319
  • 323
  • 338
  • 346
  • 362
  • 367
  • 378
  • 451
  • 470
  • 471
  • 476
  • 489
  • 494
  • 502
  • 532
  • 540
  • 611
  • 613
  • 732
  • 770
  • 772
  • 807
  • 829
  • 862
  • 863
  • 915
  • 916
  • 918
  • 922
  • 923
  • 925
  • 926
  • 927
  • 1287
  • 1333

Prompt Preview

Apply these rules to Android 16 QPR2 applications built against SDK 36.1. Use compileSdk { version = release(36) { minorApiLevel = 1 } } and targetSdk = 36 for this scope. Check the device runtime, minSdk, and targetSdk separately from compileSdk; compilation does not activate target-gated protections or make newer APIs available on older devices.

SDK boundaries and permissions

  • Guard QPR2-only APIs with Build.VERSION.SDK_INT >= Build.VERSION_CODES.BAKLAVA before checking Build.VERSION.SDK_INT_FULL >= Build.VERSION_CODES_FULL.BAKLAVA_1; SDK_INT == 36 alone cannot distinguish 36.1 from 36.0.
  • Test desugared APIs on the oldest supported Android runtime; a build JDK's library surface is not Android's runtime surface.
  • Request permissions at the operation that needs them and handle denial, revocation, and one-time grants without falling back to unrestricted access. Prefer the system photo picker or Storage Access Framework over broad media or filesystem permissions.
  • Do not treat the INTERNET permission as consent to discover or contact every device on a LAN. Constrain discovery and destinations in the app. Test Android 16 local-network protections with the RESTRICT_LOCAL_NETWORK compatibility flag enabled through adb and with NEARBY_WIFI_DEVICES denied; this is a test toggle, not an app manifest declaration.

Components, intents, and callers

  • Set android:exported explicitly on activities, services, receivers, and providers. Keep internal components unexported; protect intended cross-app entry points with suitable permissions and authorize