Verified Boot strives to ensure all executed code comes from a trusted source
(usually device OEMs), rather than from an attacker or corruption. It
establishes a full chain of trust, starting from a hardware-protected root of
trust to the bootloader, to the boot partition and other verified partitions
including system, vendor, and optionally
oem partitions. During device boot up, each stage verifies the
integrity and authenticity of the next stage before handing over execution.
In addition to ensuring that devices are running a safe version of Android, Verified Boot checks for the correct version of Android with rollback protection. Rollback protection helps to prevent a possible exploit from becoming persistent by ensuring devices only update to newer versions of Android.
In addition to verifying the OS, Verified Boot also allows Android devices to communicate their state of integrity to the user.
Background
Android 4.4 added support for Verified Boot and the dm-verity kernel feature. This combination of verifying features served as Verified Boot 1.
Where previous versions of Android warned users about device corruption, but still allowed them to boot their devices, Android 7.0 started strictly enforcing Verified Boot to prevent compromised devices from booting. Android 7.0 also added support for forward error correction to improve reliability against non-malicious data corruption.
Android 8.0 and higher includes Android Verified Boot (AVB), a reference implementation of Verified Boot that works with Project Treble. In addition to working with Treble, AVB standardized partition footer format and added rollback protection features.