Installation of applications from unknown sources in MIUI 11 is a two-sided sword. On the one hand, it gives you the freedom to set up. APK-It also opens the door to malware, phishing and unauthorized access to data, especially for Xiaomi devices, where it is useful for testing beta versions or specialized software. MIUI 11 by default allows installation from external sources for some applications (e.g. browsers or file managers).
Many users face a problem: even after disabling the main switch in security settings, some applications continue to request permission to install APK. This is due to the flexible MIUI permission system, where each installer (browser, messenger, file manager) has a separate switch. In this article, we will discuss how to completely block the installation from unknown sources at the system level and individual applications, and also consider the hidden nuances that are not written in the standard instructions.
———
Why MIUI 11 allows installation from unknown sources by default
Unlike pure Android, where the global switch blocks all attempts to install APKs from the outside, MIUI 11 uses a permission application model. This means that even if you disable the main switch in Settings → Privacy → Special Permissions → Install unknown applications, individual programs (such as Chrome, Xiaomi Files or Telegram) can retain their permission.
This architecture is due to several reasons:
- 🔹 Developer flexibility: Xiaomi allows apps to request installation permission APK regardless of system settings, which is convenient for enterprise solutions or testing.
- 🔹 Regional Features: In China (Major Xiaomi Market) Google Play is not available, so installing the game is not available. APK From external sources – standard practice.
- 🔹 Backward compatibility: MIUI 11 supports older applications that require manual update installation (e.g., some games or modified firmware).
But for most users in Russia and Europe, this model poses security risks, such as malware masquerading as a legitimate APK and infiltrating the system through vulnerabilities in file managers or browsers. According to Kaspersky data for 2023, 38% of attacks on Xiaomi smartphones occurred through the installation of applications from unknown sources.
⚠️ Note: If you have previously installed APK via a browser or messenger (such as Telegram), these apps could retain the installation permission even after the update. MIUI. Check them manually!
———
Step-by-step: how to disable APK installation at system level
To completely block an installation from unknown sources, you have to do two things: turn off the global resolution and check the settings of individual applications, starting at the system level.
- Open the settings on your Xiaomi device.
- Go to Privacy (on some devices, it may be called Security or Additional).
- Select Special Permissions (or Application Permissions depending on the version of MIUI).
- Find the option Install Unknown Applications (sometimes hidden under Installation from external sources).
- Turn off the master switch at the top of the screen. It should turn gray.
But that's not enough! As mentioned earlier, MIUI 11 saves individual permissions for applications, so the next step is to check each installer.
Open the list of applications in Install unknown applications
View all programs with resolution (usually browsers, messengers, file managers)
Turn off the switchboard for each of them.
Restart the device to apply changes-->
———
Hidden Permit Sources: Where else can APK installation access hide?
Even after disabling all visible resolutions, some apps can bypass the restrictions. Here are 5 non-obvious places where APK installation can be saved:
- 📁 File managers from third-party developers (such as Solid Explorer or other software). FX They often request installation permission on the first run and keep it.
- 🌐 Cloud storage (Google Drive, Yandex Disk, Mi Cloud) APK Directly from the cloud, the system can automatically allow installation.
- 🔧 Developer tools (e.g, ADB If you've ever used them to install applications, the permission may have been retained.
- 📱 Cloned applications (through the dual application function in the MIUI). Each copy has its own permissions!
- 🔄 System updates after updates MIUI Some permissions can be reset to default values.
To check these sources:
- Return to Settings → Privacy → Special Permissions → Install Unknown Applications
- Scroll through the list to the end, and system services may be displayed there (e.g. com.android.packageinstaller).
- Turn off permission for all suspicious items.
⚠️ Note: If you use Xiaomi.eu or custom firmware, the path to settings may be different.In some builds, the option is hidden in Settings → For developers → Security.
———
What to do if the permission is not turned off: advanced methods
If, after all the manipulations, APK installation is still possible, there may be two reasons:
- System failure (for example, after incorrect MIUI update)
- Malware that blocks changes in settings.
In such cases, resetting permissions via ADB (requires the developer mode enabled):
adb shell pm reset-permissionsIf this doesn’t work, do a full permission reset for a specific package (replace com.example.app with the problem app ID):
adb shell pm revoke com.example.app INSTALL_PACKAGESTo identify the packages, use the command:
adb shell pm list packages -f | grep 'keyword'Where keyword is part of the application name (e.g. chrome or file).
| Method | When to apply | Risks. |
|---|---|---|
| Reset via Settings | Primary setting | Low. |
| ADB-team | If the permit is not reset | Medium (requires) USB-debugging) |
| Reset to factory settings | Critical failures or viruses | High (data loss) |
| Manual removal via TWRP | For experienced users | Very high (risk of "bricking") |
Yes, several times | Yes, once | No, but I've heard of such cases | No, never-->
———
How to check if the installation from unknown sources is actually disabled
Just turning off the switch isn't enough, you have to check the locking system.
- Download any safe one. APK-file (for example, APKMirror Installer from the official APKMirror website).
- Try to open the file through Xiaomi Files or another manager.
- If a window appears with a warning "Installation is blocked" - everything is configured correctly.
- If the installation begins, it means that somewhere there is an active resolution.
Additional tests:
- 📥 Try downloading it. APK via Chrome and open it directly from the browser.
- 📎 Send. APK-file in Telegram and try to install from the messenger.
- 🔗 Use a reference of the kind intent://... to simulate installation from a web page.
⚠️ Warning: Some viruses disguise themselves as system windows and may show false reports of successful installation.Always check the list of installed applications in Settings → Annexes!
———
What happens if you leave the installation from unknown sources on
According to Dr.Web, Xiaomi devices with an installed installation from unknown sources are 3 times more likely to become targets for:
- 🕵️ Spyware (such as Cerberus or Pegasus) that steals bank card details and passwords.
- 💸 Banking Trojans (Anubis, Ginp) that replace the pages of payment systems.
- ⛓️ Rootkits that get root access and secretly mine cryptocurrency.
- 📱 Adware (malware advertising) that shows banners on top of all windows.
In 2022, Redmi Note 9 users complained massively about the xHelper virus, which was installed through a vulnerability in MIUI File Explorer and was not deleted even after resetting.
In addition to security, open permissions affect:
- 🔋 Autonomy: background checks APK-Files consume battery power.
- 📉 Performance: Package Installer system process consumes up to 15% CPU with active permits.
- 📡 Traffic: Some apps in the background download updates through APK.
💡
If you frequently install APKs from external sources, use Virustotal or MetaDefender to check files before installing them, which will reduce the risk by 80%.
———
Alternative Protection: What to Do If You Need to Install an APK Sometimes
If you need to install applications from external sources (for example, for testing or work), but want to minimize risks, use these methods:
- Temporary resolution: Enable installation for only one application (e.g. Xiaomi Files). Once you install the APK, immediately turn off the permission.
- Sandboxing: Install suspicious APKs in an isolated environment (e.g., through Shelter or Island) that will limit the app’s access to your data.
Verification via MD5/SHA-1:
- Compare the hash of the downloaded APK with the official one on the developer’s website.
- Use a tool like Hash Droid.