diff --git a/src/com/android/captiveportallogin/CaptivePortalLoginActivity.java b/src/com/android/captiveportallogin/CaptivePortalLoginActivity.java
index a7058a1..217a2b4 100755
--- a/src/com/android/captiveportallogin/CaptivePortalLoginActivity.java
+++ b/src/com/android/captiveportallogin/CaptivePortalLoginActivity.java
@@ -692,6 +692,9 @@
         // see the log-in page by browser. So, hide the link which is used to open the browser.
         @VisibleForTesting
         String getVpnMsgOrLinkToBrowser() {
+            // Before Android R, CaptivePortalLogin cannot call the isAlwaysOnVpnLockdownEnabled()
+            // to get the status of VPN always-on due to permission denied. So adding a version
+            // check here to prevent CaptivePortalLogin crashes.
             if (hasVpnNetwork() || (isAtLeastR() && isAlwaysOnVpnEnabled())) {
                 final String vpnWarning = getString(R.string.no_bypass_error_vpnwarning);
                 return "  <div class=vpnwarning>" + vpnWarning + "</div><br>";
diff --git a/tests/Android.bp b/tests/Android.bp
index d1dc11e..1791c69 100644
--- a/tests/Android.bp
+++ b/tests/Android.bp
@@ -46,4 +46,9 @@
         "libdexmakerjvmtiagent",
         "libstaticjvmtiagent",
     ],
-}
\ No newline at end of file
+    // If CaptivePortalLoginActivityTest wants to run on Q device, it needs to set sdk_version for
+    // using the portable JNI libraries.
+    // jni_uses_sdk_apis is a workaround for CaptivePortalLoginActivityTest to run on Q device.
+    // See b/154665579 to get more detail.
+    jni_uses_sdk_apis: true,
+}
diff --git a/tests/src/com/android/captiveportallogin/CaptivePortalLoginActivityTest.java b/tests/src/com/android/captiveportallogin/CaptivePortalLoginActivityTest.java
index ab9a361..d1fd0ba 100644
--- a/tests/src/com/android/captiveportallogin/CaptivePortalLoginActivityTest.java
+++ b/tests/src/com/android/captiveportallogin/CaptivePortalLoginActivityTest.java
@@ -63,6 +63,7 @@
 import android.net.Network;
 import android.net.NetworkCapabilities;
 import android.net.Uri;
+import android.os.Build;
 import android.os.Bundle;
 import android.os.ConditionVariable;
 import android.os.Parcel;
@@ -74,6 +75,7 @@
 import androidx.test.espresso.intent.rule.IntentsTestRule;
 import androidx.test.espresso.web.webdriver.Locator;
 import androidx.test.ext.junit.runners.AndroidJUnit4;
+import androidx.test.filters.SdkSuppress;
 import androidx.test.filters.SmallTest;
 
 import com.android.testutils.TestNetworkTracker;
@@ -324,8 +326,7 @@
         assertTrue(mActivity.isAlwaysOnVpnEnabled());
     }
 
-    @Test
-    public void testVpnMsgOrLinkToBrowser() throws Exception {
+    private void runVpnMsgOrLinkToBrowser(boolean useVpnMatcher) {
         initActivity(TEST_URL);
         // Test non-vpn case.
         configNonVpnNetwork();
@@ -341,7 +342,25 @@
         // Test always-on vpn case.
         configNonVpnNetwork();
         doReturn(true).when(sMockDevicePolicyManager).isAlwaysOnVpnLockdownEnabled(any());
-        assertTrue(mActivity.getWebViewClient().getVpnMsgOrLinkToBrowser().matches(vpnMatcher));
+        assertTrue(mActivity.getWebViewClient().getVpnMsgOrLinkToBrowser().matches(
+                (useVpnMatcher ? vpnMatcher : linkMatcher)));
+    }
+
+    @Test @SdkSuppress(maxSdkVersion = Build.VERSION_CODES.Q)
+    public void testVpnMsgOrLinkToBrowser_BeforeR() throws Exception {
+        // Before Android R, CaptivePortalLogin cannot call isAlwaysOnVpnLockdownEnabled() due to
+        // permission denied. So CaptivePortalLogin doesn't know the status of VPN always-on, and it
+        // simply provides a link for user to open the browser as usual.
+        runVpnMsgOrLinkToBrowser(false /* useVpnMatcher */);
+    }
+
+    @Test @SdkSuppress(minSdkVersion = Build.VERSION_CODES.R)
+    public void testVpnMsgOrLinkToBrowser() throws Exception {
+        // After Android R(including), DevicePolicyManager allows the caller who has the
+        // PERMISSION_MAINLINE_NETWORK_STACK can call the isAlwaysOnVpnLockdownEnabled() to get the
+        // status of VPN always-on. So the CaptivePortalLogin could know the status of VPN always-on
+        // and show the related warning message to the user.
+        runVpnMsgOrLinkToBrowser(true /* useVpnMatcher */);
     }
 
     private void notifyCapabilitiesChanged(final NetworkCapabilities nc) {