On Android, the ability to install applications from sources outside of the official Google Play Store (sideloading) is governed by a strict permission called “Install Unknown Apps.” Historically a master toggle, modern Android handles this on a per-app basis, meaning your web browser (like Chrome) or file manager can request permission to execute an APK file. While sideloading is essential for developers or power users installing specialized FOSS applications, leaving this permission granted to everyday apps is a massive security risk. It allows malicious advertisements or compromised file managers to silently download and prompt the installation of malware, ransomware, or spyware directly onto your device.
This guide explains how to completely disable the “Install Unknown Apps” permission system-wide across all applications on your Android device, securing it against rogue APK execution.
Revoke the Install Unknown Apps Permission
To lock down the device, you must audit the special app access menu and revoke this privilege from any application that currently holds it.
- Open the main Settings app on your Android smartphone.
- Scroll down and tap on Apps (or “Apps & notifications”).
- Scroll down to the bottom and tap on Special app access. (On some devices, you may need to tap an “Advanced” dropdown first, or tap the three-dot menu in the top right to find “Special access”).
- Locate and tap on Install unknown apps.
- You will see a list of applications capable of requesting this permission (e.g., Chrome, Files by Google, Drive, third-party browsers).
- Tap on every single app in this list that says “Allowed”.
- Toggle the switch labeled Allow from this source to the Off (grey) position.
Verify the Security Lockdown
By toggling this off for all apps, you instruct the Android Package Manager to unconditionally reject any installation intent triggered by a third-party application, forcing all app installations to route exclusively through authorized storefronts like the Google Play Store.
To verify the lockdown is successful, open your web browser (e.g., Chrome) and download a benign APK file (such as the open-source F-Droid client). Once downloaded, tap “Open” on the file. Instead of launching the Android package installer, the system will immediately block the action and display a security prompt stating, “For your security, your phone is not allowed to install unknown apps from this source.” Your device is now secured against unauthorized sideloading.