The oddest app update in my 16 years of owning smartphones happened last November.
My Samsung Galaxy S23 running Google’s Android 13 operating system notified me that some updates were ready to be installed from the Galaxy Store, which Samsung ships on its devices as a complement to Google’s Play store. The Galaxy Store’s occasional push alerts typically suggest updating Samsung services such as its Clock app or obscure gaming engines. Routine as they are, I tapped the notification, waited for the store to load, and reflexively hit “Update all.” Only after the updates started installing did I notice that the Bank of America app was on the list.
I panicked. Was this some sort of malicious hack? Was a rogue Bank of America app taking over my real one? Why was the Samsung store, instead of Google’s Play store, suddenly updating one of my longtime apps? I couldn’t recall having seen anything like this before, and I soon learned it wasn’t just me. For years, Android users have expressed fear and confusion on Reddit, Samsung’s support forum, and elsewhere about apps being updated by unexpected stores.
My scare with Bank of America was my introduction to Android’s “clobbering” problem, which Google warns could grow worse under a US court order expected in the coming weeks. The order will aim to undo the tech giant’s illegal Play store monopoly by requiring Google to be more accommodating to app stores other than its own. If the order achieves the intended effect and Google loses its appeals in the case, more Android users may find themselves surprised as a growing number of app stores on their phones vie to own the app update process.
That app store warfare is what Google internally refers to as clobbering, and as with so much in life, money and data drive the issue. The battle that led to a San Francisco federal jury declaring Google Play an illegal monopolist all started with Epic Games encountering hurdles trying to distribute its Fortnite game without having to share what it viewed as an unfair amount of sales with Google.
Nearly every app store, including one developed by Epic, wants a bigger piece of users’ in-app purchases and a better sense of users’ activity within and among apps. The more users interact with an app store, the better chance it stands of increasing income and insights.
But Google has maintained from the onset of its fight with Epic that fiddling with well established boundaries of the Android industry could leave users worse off. For instance, clobbering can trigger apps to break down, and the possibility of more app failures is just one of the potential downsides Google has raised. The challenge for US district judge James Donato as he drafts his forthcoming order is to give users more control—like over which app stores they can use—without plunging them into a new maze of frustrations no easier to navigate than today.
Samsung and Bank of America didn’t immediately respond to requests for comment for this story. Google and Epic both declined to comment.
Cross-store updates trace back to Android’s roots in the fairly open Linux platform, and they come with benefits. As app updates go through security reviews and other store-specific checks, a download might arrive at varying times across app stores. By allowing any of the app stores installed on their phone to update an app, users can ensure their apps are up to date as soon as possible to resolve bugs or security vulnerabilities, says Bogdan Botezatu, director of threat research and reporting at cybersecurity company Bitdefender. “Users should not be worried about getting the update,” he says.
In an encouraging sign, an analysis of three popular apps at WIRED’s request by Esther Onfroy, cofounder of security research company Defensive Lab Agency, found no difference between copies of the same app downloaded from Google Play and the Galaxy Store.
There are risks to cross-store updates, though those risks are remote, Onfroy says. An app store with weak security could be exploited to ship a malicious update, and having more stores on a device raises the prospect of just one of them being corrupted. An app store also could wrap an update with code that enables some form of intrusive data collection.
Users are more likely to encounter nuisances like updates from other app stores that don’t function properly. Edward Cunningham, a director of product management at Google, told Donato in court papers that in 2022, smartphone maker Oppo’s app store released an unauthorized and outdated update of Google’s Chrome browser. Some users who installed the update couldn’t load web pages on Chrome.
On Reddit, users have complained about Google Play updating apps downloaded from the Amazon Appstore, stifling their ability to access subscription features or pay with virtual currencies unique to apps from Amazon’s marketplace. In a June court filing, Google’s attorneys acknowledged that users can lose in-app purchases and subscriptions. App stores support varying billing systems, and the billing system used in the current update of the app may be the only one that works. So if a game downloaded from Epic’s store is updated by Google Play, it may be Google and no longer Epic that gets a commission on in-app purchases, and items acquired in the past may not function as intended.
Cross-store updates also can trigger more frequent app crashes, in part because they can disrupt the staggered launches that app developers sometimes use to catch bugs before they spread—the sort of measure that helps avert disasters such as the recent CrowdStrike meltdown.
Adding to the confusion over clobbering, app developers can limit updates from multiple app stores by publishing to each store under different credentials or version numbers. But then if users do want to switch to updates from a different app store, they may have to reinstall the app by downloading a new version from their preferred store, and they might lose some data in the process. Users who want to preserve the current version of an app because they prefer it also may be disappointed if they turn off updates from one store while not realizing that they need to also turn off updates from another store.
Sean O’Brien, a cybersecurity lecturer at Yale Law School and founder of Yale Privacy Lab, says users must be better informed about the prospect of clobbering and should be given more control over it. “No one should have apps installed on a smartphone under their noses,” he says.
The updates feature on Samsung’s store lists when apps originated from Google Play but doesn’t state the benefits of processing upgrades through Samsung’s marketplace. Why, for example, should I let Samsung keep updating my Bank of America app? What do I gain or lose, if anything?
A Samsung customer service representative I contacted last year explained that “app developers create specific versions of their apps optimized for different devices or platforms” and that the Bank of America app on the Galaxy Store could be offering unspecified “additional features or improvements.”
An outdated update from Oppo’s app store broke Google Chrome for some Oppo phone users in 2022.
Photograph: Getty Images
Despite the stream of user complaints, clobbering didn’t attract widespread attention in the first 15 years of Android’s history. Suddenly, when Google launched Android 14 late last year, the company tried to address the issue. Until that point, preloaded app stores, including Samsung’s Galaxy Store, could update any app without clear user permission or prominent notification, according to Google. Stores downloaded by users could update apps previously installed from elsewhere only with user permission, though issues could still arise.
Android 14 began allowing app stores to declare themselves as the exclusive source of updates of specified apps. Users can opt into apps being updated by any app store only if they accept a message warning that mixing stores “could affect an app’s functionality.” The process “ensures that you won’t unexpectedly receive updates for these apps from a different store,” a Google spokesperson told Android Police in February.
But roughly only a quarter of Android devices in the world are estimated to be running Android 14, and it’s unclear whether app stores have claimed exclusive rights to update a significant number of apps.
In its proposal to remedy Google Play’s monopoly, Epic wants Google to tweak the Android 14 feature. It’s called on Donato to require Google to allow users with just a click or two to shift all of their apps to updating from the same app store. But Google’s Cunningham told Donato that enabling a bulk shift in power to a single store could lead to users missing critical updates and overall “reintroducing the very problems the Android 14 solution set out to address.” Cunningham’s preference is to preserve the existing setup in which users can tap one by one through their apps to enable updates from all the stores on their device.
Epic’s concern is that the current process ensures Google Play is never cut out of the picture, as long as it has the apps needing updates. “Google’s proposal to continue to allow clobbering would disincentivize users from moving ownership of updates away from the Play Store and to third-party stores,” Epic’s attorneys wrote to Donato. The Play Store would “continue delivering updates, even when the user would prefer to have updates delivered only by a competing store.”
Overall, Epic’s proposal calls for Google Play to allow downloads of other app stores. These app stores could receive a list of apps in Play and market them so that storefronts become just as worthwhile for users to browse. Google would handle downloads and updates of apps that aren’t directly published in rival stores. In court filings, Google contends that the proposed changes would cost tens of millions of dollars to develop.
At a hearing before Donato this week, attorneys and technical experts argued over whether Google should have months or potentially more than a year to comply with the proposed requirements and for how many years they should remain in effect. “There’s quite a number of complexities we have to work out solutions for,” Google’s Cunningham told Donato. “I wouldn’t claim any of this is infeasible, but it will take some time.”
Donato said it would take him at least a couple of weeks to finalize his order, which he added would establish a three-person committee to monitor Google’s compliance. He suggested Epic and Google each appoint one of their technical experts, and the pair would then jointly select someone from the app development industry to join them. Donato’s questions suggested that he will be looking out for users’ interest. “I have a commitment to remedy this wrong found by the jury,” he said. If he squares everything just right, users may be spared from their own frights and annoyances over app updates.
