Per-app permission on Android 8.0 and later, and what it does not change.
Reading time: 5 min read
What the permission does
Install unknown apps is a per-app permission on Android 8.0 and later. It grants one chosen app (typically a browser, the Files app, or a messaging app) the right to start the install flow for APKs from outside Google Play. It does not lower the device's security baseline. The device's Play Protect, the lock screen, the per-app data sandbox and the device-wide encryption all stay where they were. A reader who grants the permission to one browser and a different browser is granting the permission twice; a reader who grants it to one browser only is granting the permission once.
Editor note. Editor note on the scope: the permission is scoped to one app, not to the device. A reader who grants the permission to Chrome and then installs an APK from Firefox will be asked to grant the permission to Firefox as well.
What the permission does.
How to enable it on Android 8.0 through Android 13
Settings > Apps > Special access > Install unknown apps. Pick the app you intend to install with. Toggle on. The toggle stays on until the reader turns it off; the system does not auto-revoke. A reader who wants the permission to auto-revoke after each install can use a third-party tasker-style automation, but the default behaviour is to keep the toggle on. The default is a security-positive design: a reader who has granted the permission to one app does not have to grant it again the next time they want to install from that app.
Editor note. Editor note on Android 8.0 to 13: the path Settings > Apps > Special access > Install unknown apps has been stable across these Android versions. A reader who cannot find the path is looking for it under Settings > Security instead; both paths lead to the same panel.
How to enable it on Android 8.0 through Android 13.
How to enable it on Android 14
On Android 14, the path is the same but the system shows a confirmation dialog before the install runs. The dialog is a final check that the reader knows the APK is from outside Google Play. Tap Install. A reader who taps Cancel at the confirmation prompt can retry without re-granting the permission.
Editor note. Editor note on Android 14: the confirmation prompt is a per-install dialog, not a per-app permission. The permission is still granted to the browser; the prompt is just a final check.
How to enable it on Android 14.
What the permission does NOT do
It does not install anything automatically. It does not weaken Play Protect. It does not transfer the permission to other apps. It only lets the chosen app start the install flow. A reader who grants the permission is granting the right to start the install flow, not the right to install anything without consent. The reader still has to tap Install at the final confirmation prompt on Android 14.
Editor note. Editor note on the scope of the permission: the permission is the right to start the install flow. The reader still has to tap Install at the final confirmation prompt. A reader who treats the permission as a blanket allow-all is misreading the surface.
What the permission does NOT do.
When to disable the permission
Turn it off when the install finishes. The system holds the choice until the reader changes it. A reader who keeps the permission on for a browser they no longer use is leaving a stale allow in place; disabling the permission after the install is the cleanest way to keep the surface small.
Editor note. Editor note on disabling the permission: the toggle is in the same panel as the enable step. Settings > Apps > Special access > Install unknown apps > toggle off. The reader does not have to uninstall the app to disable the permission.
When to disable the permission.
Confirm the source before granting the permission
Before granting the permission, confirm the developer site URL is the one the reader intended to visit. The apps library lists the entries we have already opened on the developer site; an entry not on the list is a candidate for the contact submission. A reader who grants the permission to a typosquat URL is granting the permission to a malicious install.
Editor note. Editor note on the source check: open the developer site in a new tab and verify the URL against the one listed on the games library entry. A reader who trusts the URL bar without checking is the most common source of typosquat installs.
Confirm the source before granting the permission.
Where the Install unknown apps panel lives
Settings > Apps > Special access > Install unknown apps. The panel lists every app installed on the device, with a toggle next to each app. The toggle is off by default; granting the permission flips the toggle on. The panel is the single source of truth for which apps have the permission. A reader who wants to audit the permission surface opens the panel and checks the toggle state for each app.
Where the Install unknown apps panel lives.
How the panel differs from the data permission panel
The Install unknown apps panel is a special-access panel, not a data-permission panel. A data-permission panel lists permissions like camera, microphone and location; the Install unknown apps panel lists apps that can install other apps. The two panels are separate: a reader who grants camera permission to an app does not grant install permission, and vice versa.
How the panel differs from the data permission panel.
How the permission interacts with Play Protect
Play Protect scans the APK before the install runs. The scan is independent of the Install unknown apps permission: a reader who has the permission on does not skip the Play Protect scan. A reader who disables Play Protect is removing a separate layer of the device security baseline; the Install unknown apps permission does not affect Play Protect.
How the permission interacts with Play Protect.
Common pitfalls on the Install unknown apps permission
Three pitfalls show up often in reader mail. The first is granting the permission to a browser the reader no longer uses: the toggle stays on until the reader turns it off, so a stale allow is a security-positive concern. The second is treating the permission as a blanket allow-all: the permission is the right to start the install flow, not the right to install anything without consent. The third is uninstalling an app to revoke the permission: uninstalling the app and revoking the permission are two separate actions, and uninstalling does not affect the permission. A reader who treats these three pitfalls as a single workflow is reading the surfaces as coupled when they are independent. The apps library lists the entries we have already opened on the developer site; an entry not on the list is a candidate for the contact submission.
Common pitfalls on the Install unknown apps permission.
A short checklist for granting the install permission
Before granting the Install unknown apps permission to a browser, run the following short checklist. Confirm the developer site URL matches the games library entry. Confirm the changelog line carries a date and a version string. Confirm the support email is reachable by sending a test message. Open Settings > Apps > Special access > Install unknown apps and toggle on the permission for the browser you intend to install from. Toggle off the permission for any browser you no longer use. Tap the APK link and wait for the file to land. Open the file and tap Install at the final confirmation prompt on Android 14. Toggle off the permission after the install finishes. The checklist covers the pre-grant verification work and the post-grant verification work in eight steps. The eight steps take about five minutes. The five minutes is the cheapest way to verify the source, the version and the developer. Together the eight steps and the five minutes protect the reader from the most common reader pitfalls on Yono-style apps in this game type. The apps library lists the entries we have already opened on the developer site; an entry not on the list is a candidate for the contact submission.
A short checklist for granting the install permission.
