Introduction
As I previously wrote here, all Nothing Phone (2) owners risk losing the ability to pass MEET_STRONG_INTEGITY starting September 6, 2025.
Why does this happen?
As of May 21, 2025, Google updated its Play Integrity APIs, which (very questionably) attest to the integrity of an Android 13+ device. The APIs provide three integrity levels: Basic, Device, and Strong. To pass Strong attestation, an Android 13+ device must: pass basic and device attestation, have a stock OS, a locked bootloader, and a security patch within the last year.
And this is where the problems arise. By security patches within the last year, Google doesn’t just mean Android security patches (called system patches or OS patches), but also controls vendor patches, and possibly even boot. [SOURCE].
Status of Nothing Phone (2)s
To check the patch levels of your Android phone, you can download this free app from the Play Store or GitHub, called Key Attestation Demo.
If the app says that the device IDs could not be attested when you open it, click on the three dots in the top right and disable the “Attest device props” flag.
At the bottom of the page, you’ll see “OS patch level” (which indicates the Android patches), “Vendor patch level” (for the vendor partition), and “Boot patch level” (for the boot partition).
The problem with Nothing Phone 2s is that the vendor patch level is 20240905, which means that September 5, 2025, will be one year later.
Therefore, as explained above, Nothing Phone 2s will likely fail the MEET_STRONG_INTEGRITY check.
What will be the consequences?
If this were to happen, starting September 6, 2025, anyone with a Nothing Phone (2) may no longer be able to use some apps that rely on MEET_STRONG_INTEGITY, such as banking apps, digital IDs, or apps that require high security.
Considering that Nothing had declared 3 major Android updates and 4 years of security patches, it would mean that, if they don’t fix it in these 10 days, after just over 2 years the Nothing Phone 2 will not have the latest security updates, with the consequences already described.
How can I fix this?
The only way to prevent this from happening is for Nothing to release an OTA update in time, that updates the vendor patches (which expire on September 5, 2025) and the boot patches (which expire on December 5, 2025).
Are other Nothing phones affected?
I don’t know, but if you own another Nothing or CMF phone, you can use the procedure above to check if you’re affected.
—
This specifically affects all Nothing Phone 2s running Nothing OS 3.2 (Pong-V3.2-250708-2227-EEA) and earlier.
—
DISCLAIMER: Publicly available information online regarding the exact functioning of the new Play Integrity API is very sparse. I’m not 100% sure Google also controls the patch level of the vendor or boot partition, but it appears that way from what I’ve found online. If you know anything more, I’d love to hear it.
