Why You Need To Stop Using Instant Apps On Your Android Phone

Did you know it's possible to use Android apps on your smartphone without actually installing them? Google calls them instant apps, a neat innovation originally introduced at Google I/O in 2016.

Now referred to as "Google Play Instant" (via Android Developers), instant apps conveniently show content within the app's native environment without a full install, via Google sort of "streaming" its user interface and content to your device. You'll most often see a prompt to use an instant app when you're searching for content or shopping through Google search. Instead of reading that content in the website's standard native view, Google will offer to take you directly into the app and show it there, almost as slick as if you'd fully downloaded it. For those who prefer to use apps over mobile websites, it can seem like a dream come true.

So why exactly do people want to use instant apps? For starters, it's a great way to preview how an app works before deciding to install it yourself. It can be especially useful for quickly checking out at an online store that you don't frequent often enough to install an app for — all with a more streamlined user interface. It also supports a limited number of games. Imagine being able to take a stab at a word puzzle your friend shared with you without having to go through the hassle of finding and installing it.

Google's original vision for instant apps (per Android Developers) was a little more magical, with use-case scenarios including a parking meter that can instantly pull up its native payment portal when tapping it with your phone's wireless NFC (near-field communication) chip. Despite the convenience possibilities, this feature hasn't exactly set the world ablaze, likely due to a lack of A practical and sustained need from the common user. As such, there are only a handful of apps that actually support it in any meaningful way these days, and you would almost never notice its availability in your day-to-day usage if you don't frequent those outlets.

Instant apps do come with a couple of downsides, chief among them being that any data you store in the app is only temporary. That means that you would likely have to resubmit your login credentials or payment information the next time you need to use it. Instant apps also still need to use some storage for data and visual elements the app needs while in use. That amount is negligible (usually 4-6 megabytes) compared to a full app install from Google Play as it only loads the elements it needs to show the content you've searched for, so there's no major downside to using them if storage space tops your list of concerns. Instant apps also can't interact with your device as intimately as a native app can.

More concerning is speculation that, given the opportunity, a hacker could find a way to inject malicious code onto an unsuspecting user's device by exploiting vulnerabilities in Chrome and Android. A browser bug that was made known to the public in 2019, for instance, could have allowed an attacker to intercept sensitive information by using an exploit at the application level (via NIST). That bug was fixed almost immediately in the Chrome 72 update released on January 29, 2019, according to Google. Most Android smartphones running version 7 or later should be safe from that specific exploit, according to Positive Technologies researcher Sergey Toshin (via Tech Republic) as smartphones immediately received a fix for the bug over the air.

There are also fears among the developer and cybersecurity communities that an attacker could find a way to secretly inject malicious code through this sort of hole, though there haven't been any substantial reports of active threats. In 2019, security researcher Ronny Xing demonstrated working attacks at a closed-door conference. Then, a 2020 study published by The Hong Kong Polytechnic University explored methods by which an attacker could hijack links on Android. It found that more than 50,000 apps out of a total 200,000 could be exploited without proper code fixes by the developers. Despite Google releasing regular security updates to address potential issues, the sheer possibility might scare some away from using instant apps altogether. 

If you'd rather not deal with instant apps, you'll be happy to know how easy it is to disable them. According to Google, not all Android phones support instant apps. If yours does, you can disable it by opening the settings menu in the Google Play app and navigating to General > Google Play Instant. From here, simply toggle off the "Upgrade Web Links" option. With this off, search links will no longer open using instant apps, though you can still launch instant apps manually by tapping the "Try Now" button on its Google Play Store listing. This menu also allows you to see a running list of instant apps you've tried in the past. You can tap each to see more info about it. It'll show you how much data it's using before giving you the option to clear it.

If you'd rather use instant apps, you'll want to be aware of some extra options available to you. One of the most important things to know is that, on some devices, you can manage individual permissions for each instant app just as you would a regular one, giving you granular control over whether they can access your camera or microphone, for example. This is an important feature for those with security and privacy concerns. To change these, you'll need to head into the app's info view as described above and tap permissions.