Google is rolling out Android 17 QPR2 Beta 3 to compatible Pixel devices, introducing a native App lock feature that requires biometric or PIN authentication before opening specific applications. According to 9to5Google, the update also hardens system security by restricting programmatic call-forwarding requests to combat mobile fraud.
Native App Lock Architecture on Pixel Devices
With the arrival of Android 17 QPR2 Beta 3, a native App lock capability is embedded directly into the Pixel launcher ecosystem. When users long-press an application icon to access the contextual actions menu, a new “App lock” toggle appears alongside standard options like App info, Pause app, Widgets, Remove, and Bubble, as detailed by 9to5Google.
Triggering this feature demands immediate system-level verification. Upon tapping a locked application, the Android OS presents a system authentication sheet requiring a Fingerprint Unlock or a verified PIN. Under the hood, the operating system executes strict privacy protocols. Notification contents for locked apps are automatically hidden from the shade, and associated widgets or shortcuts are stripped from the home screen.
Google notes that AI agents and system services granted explicit access to an application can still read its data stream. Users can manage this entire security matrix by navigating to Settings > Security & privacy > App lock to audit active locks, add new restrictions, or disable protections instantly.
Hardening Telephony Against Call-Forwarding Fraud
Beyond visual and interface changes, Android 17 QPR2 Beta 3 introduces aggressive mitigation strategies against social engineering and telephony abuse.
To eliminate this vector, Google has implemented code-level restrictions within the telephony framework. The system now parses and selectively restricts call-forwarding USSD strings—such as the common 21 sequence—executed programmatically via the TelephonyManager.sendUssdRequest() API. Standard applications attempting to execute these specific commands in the background will be blocked immediately, triggering a USSD_ERROR_NOT_ALLOWED callback.
API Restriction & System Confirmation Breakdown
- API Enforcement: The
sendUssdRequest()API no longer accepts call-forwarding codes utilizing only theCALL_PHONEpermission. - Exempted Traffic: Non-call-forwarding USSD requests, including mobile money transfers and account balance checks, remain completely unaffected by this update.
- Manual Dialing: Users manually inputting call-forwarding sequences through the system dialer will encounter an OS-level confirmation dialog designed to thwart remote social engineering coercion.
Developers whose applications rely on automated setup workflows are advised by 9to5Google to migrate their code architecture. Affected software must handle the failure callback gracefully or transition to the ACTION_DIAL intent. This forces the OS to pre-fill the dialer, ensuring a human operator explicitly approves the execution.
Ecosystem Rollout and Availability
The preview build cycle for the upcoming December public release continues at a rapid pace. Android 17 QPR2 Beta 3 arrived ahead of schedule, landing on a Friday and expanding developer access across a massive hardware footprint. Supported devices span from the Pixel 6a generation up to the latest Pixel 10 hardware family, including specialized form factors like the Pixel Tablet, Pixel Fold, and Pixel Pro Fold iterations.
Developers testing these builds should verify that their applications correctly handle the new telephony restrictions and UI states.
