A phone call that looks normal can, with one wrong code, silently redirect itself to someone else.

That’s the loophole Google is closing in Android 17 QPR2 Beta 3. The update blocks apps from using the sendUssdRequest() function to trigger call‑forwarding commands unless they have the highest level of telephony permission. In plain English: apps can no longer quietly reroute your calls by slipping in a special string of numbers. And if you try to forward calls yourself, the system now throws up a confirmation dialog, forcing you to acknowledge what’s happening before the network accepts it.

“Android 17 Beta 3 shuts down silent call forwarding — every USSD code now demands your approval.”  
Credit: Droid Life


That single change is the headline, but it’s not the only one. The beta also fixes a pair of issues that have been frustrating Pixel owners. The notification shade and Quick Settings panel, which had been prone to crashing or showing corrupted visuals, now behave normally. And the Device Health and Support tool, which had been incorrectly warning some users about battery degradation, has been corrected. These are small fixes, but they matter because they touch the parts of the phone you interact with every day.

The rollout covers Pixel 6a through Pixel 10, including the 10a. The Pixel 11 series, still in pre‑order, isn’t included yet. That exclusion is deliberate: Google wants the new hardware to ship with stable software, not beta builds. For everyone else, the update is available immediately, either through the Android Beta Program or by manually flashing OTA images.

The technical details are precise. Build numbers CP41.260731.005.A2 and CP41.260731.005.B1 carry the August 5, 2026 security patch. Google Play services are updated to version 26.26.34. Emulator support extends to x86 64‑bit and ARM v8‑A, which means developers can test across the architectures most relevant to modern devices. These numbers aren’t filler; they’re the identifiers that tell you exactly which version you’re running, and they matter when you’re debugging or reporting issues.

The security change around USSD codes deserves a closer look. USSD — Unstructured Supplementary Service Data — is the system that lets you dial short codes like 21 or *#06# to trigger network functions. It’s powerful because it talks directly to your carrier. But that power has been abused. Fraudsters have used USSD to trick phones into forwarding calls, intercepting two‑factor authentication messages or sensitive conversations. By requiring explicit user confirmation and restricting app access, Google is cutting off one of the easiest paths for that kind of attack.

For developers, the implication is clear. If your app relied on USSD to handle call forwarding, it won’t work the same way anymore. You’ll need to rethink the workflow, possibly by guiding users through manual steps instead of automating them. That’s inconvenient, but it’s also safer. The trade‑off is between friction and security, and Google has chosen security.

For users, the experience is subtle. You won’t notice the change unless you try to forward calls or use an app that once did it for you. What you will notice is fewer crashes, fewer false battery warnings, and a system that feels more stable. Stability is the quiet currency of trust in software. You don’t think about it when it’s there, but you feel its absence immediately.

The timing of the release is also worth noting. QPR — Quarterly Platform Release — updates are Google’s way of shipping mid‑cycle improvements without waiting for the next major version. Beta 3 suggests we’re close to the final QPR2 release, which will roll out broadly once testing is complete. That cadence keeps Android evolving in smaller, safer steps, rather than giant leaps that risk breaking things.

What this update signals is a shift in priorities. The flashy features will come later. Right now, Google is tightening the bolts: securing the telephony stack, cleaning up the interface, correcting diagnostics. It’s the kind of work that doesn’t make headlines but defines the reliability of the platform. And reliability is what makes people stick with a device year after year.

The next time you dial a code to forward your calls, you’ll see a dialog box asking if you’re sure. That pause — that moment of friction — is the point. It’s Google inserting itself between you and a potential scam, turning a silent vulnerability into a conscious choice. It’s not dramatic, but it’s decisive. And it hints at the direction Android is heading: less about what’s new on the surface, more about what’s secure underneath.

Sources: Droid Life