diff --git a/build.xml b/build.xml
index abe465528..c55aff304 100644
--- a/build.xml
+++ b/build.xml
@@ -244,8 +244,8 @@ under the License.
     <!-- license and api checks -->
     <property name="rat.jar" location="${main.lib}/apache-rat-0.12.jar"/>
     <property name="rat.url" value="${repository.m2}/maven2/org/apache/rat/apache-rat/0.12/apache-rat-0.12.jar"/>
-    <property name="forbidden.jar" location="${main.lib}/forbiddenapis-2.5.jar"/>
-    <property name="forbidden.url" value="${repository.m2}/maven2/de/thetaphi/forbiddenapis/2.5/forbiddenapis-2.5.jar"/>
+    <property name="forbidden.jar" location="${main.lib}/forbiddenapis-2.6.jar"/>
+    <property name="forbidden.url" value="${repository.m2}/maven2/de/thetaphi/forbiddenapis/2.6/forbiddenapis-2.6.jar"/>
 
     <property name="maven.ooxml.xsds.version.id" value="1.4"/>
 	
@@ -652,6 +652,7 @@ under the License.
                 <include name="forbiddenapis-2.0.jar"/>
                 <include name="forbiddenapis-2.1.jar"/>
                 <include name="forbiddenapis-2.3.jar"/>
+                <include name="forbiddenapis-2.5.jar"/>
                 <include name="apache-rat-0.11.jar"/>
                 <include name="mockito-core-2.13.0.jar"/>
             </fileset>
diff --git a/src/java/org/apache/poi/util/StaxHelper.java b/src/java/org/apache/poi/util/StaxHelper.java
index 58a495969..31530c2e7 100644
--- a/src/java/org/apache/poi/util/StaxHelper.java
+++ b/src/java/org/apache/poi/util/StaxHelper.java
@@ -34,7 +34,7 @@ public final class StaxHelper {
      * Creates a new StAX XMLInputFactory, with sensible defaults
      */
     public static XMLInputFactory newXMLInputFactory() {
-        XMLInputFactory factory = XMLInputFactory.newFactory();
+        XMLInputFactory factory = XMLInputFactory.newInstance();
         trySetProperty(factory, XMLInputFactory.IS_NAMESPACE_AWARE, true);
         trySetProperty(factory, XMLInputFactory.IS_VALIDATING, false);
         trySetProperty(factory, XMLInputFactory.SUPPORT_DTD, false);
@@ -46,7 +46,7 @@ public final class StaxHelper {
      * Creates a new StAX XMLOutputFactory, with sensible defaults
      */
     public static XMLOutputFactory newXMLOutputFactory() {
-        XMLOutputFactory factory = XMLOutputFactory.newFactory();
+        XMLOutputFactory factory = XMLOutputFactory.newInstance();
         trySetProperty(factory, XMLOutputFactory.IS_REPAIRING_NAMESPACES, true);
         return factory;
     }
diff --git a/src/resources/devtools/forbidden-signatures.txt b/src/resources/devtools/forbidden-signatures.txt
index e64d7e02c..9fda92e1b 100644
--- a/src/resources/devtools/forbidden-signatures.txt
+++ b/src/resources/devtools/forbidden-signatures.txt
@@ -123,6 +123,11 @@ java.util.concurrent.Future#cancel(boolean)
 @defaultMessage Don't use ...InputStream.available() as it gives wrong result for certain streams - use IOUtils.toByteArray to read the stream fully and then count the available bytes 
 java.io.InputStream#available() 
 
+@defaultMessage Use newInstance, as newFactory does not seem to work on Android - https://github.com/centic9/poi-on-android/issues/44#issuecomment-426517981
+javax.xml.stream.XMLEventFactory#newFactory()
+javax.xml.stream.XMLInputFactory#newFactory()
+javax.xml.stream.XMLOutputFactory#newFactory()
+
 @defaultMessage Unnecessary, inefficient, and confusing conversion of String.toString
 java.lang.String#toString()