Android 17 QPR2 Beta 3 is rolling out to Pixel phones, and the headline change is not a new toggle or a colour slider. Google has locked down how apps and scam callers can turn on call forwarding, adding a system-level confirmation prompt before any forwarding code runs and cutting off a background API that malicious apps could previously abuse. Google’s release notes describe it plainly: “Android 17 QPR2 Beta 3 introduces new security restrictions on programmatic call forwarding to protect users from fraud.”
What the Android 17 QPR2 call forwarding change actually does
Call forwarding hijacking is one of the oldest and most effective phone scams still working. The victim is talked into dialling a short USSD code that silently redirects their incoming calls to an attacker’s number. Once that is set, bank verification calls go somewhere else entirely, and the victim’s handset gives almost no visible sign anything changed. It costs the scammer nothing but a convincing phone call.
Beta 3 attacks this from two directions, according to the release notes reproduced by 9to5Google. The first is an API restriction: sendUssdRequest() can no longer be used for call-forwarding codes by an app holding only the CALL_PHONE permission. An ordinary app trying to fire one of those codes in the background is blocked outright and gets a USSD_ERROR_NOT_ALLOWED callback instead. The second is the part users will actually see — dial a call-forwarding code yourself in the system dialler and Android now throws up an OS-level confirmation dialog before executing it, which Google’s notes tie explicitly to combating social engineering scams.
Importantly, the change is scoped narrowly. Google’s notes state that non-call-forwarding USSD requests, and they name mobile money transfers and account balance checks specifically, are unaffected. That matters a great deal in markets where USSD is everyday infrastructure rather than a curiosity — mobile money in much of Africa, prepaid balance and data-pack checks across India, Southeast Asia and Latin America. A blunter version of this fix would have broken those flows; this one does not appear to.
Worth being clear-eyed about the limits, though. A confirmation dialog only helps if the person reading it understands what they are agreeing to, and the entire premise of this scam is a caller who has already talked the victim past their better judgement. Google is buying the user one more moment to stop, not closing the hole. Developers with a legitimate need to set up forwarding are told to migrate to an ACTION_DIAL intent that pre-fills the dialler and leaves the final tap to the user.
The customisation changes in Beta 3
The rest of the release is where Pixel owners get things to play with. Android Police reports a new Quick Settings layout editor that lets you place tiles wherever you want, including dragging the brightness slider and media player down to the bottom of the panel where they are easier to reach one-handed. Theming gets a hue slider for fine-tuning the accent colour on top of the four main colour styles, a control Google had previously only tested in an Android Canary build. Blur effects have also been extended to the lock screen shortcuts, the fingerprint button and notifications, so the wallpaper shows through elements that used to be flat opaque panels.
Two bugs are fixed as well. 9to5Google publishes the changelog: opening the notification shade and Quick Settings could cause visual corruption and an unexpected device restart, and the Device Health and Support tool was showing users false battery capacity degradation warnings. The second one is the kind of bug that sends people shopping for a battery replacement they do not need.
Which Pixels get Android 17 QPR2 Beta 3
Google is shipping the build as an over-the-air update to anyone enrolled in the Android Beta Program, with system images posted for the following devices, plus the Android Emulator. Build numbers are CP41.260731.005.A2 and CP41.260731.005.B1.
- Pixel 6 series: Pixel 6a
- Pixel 7 series: Pixel 7, Pixel 7 Pro, Pixel 7a
- Pixel 8 series: Pixel 8, Pixel 8 Pro, Pixel 8a
- Pixel 9 series: Pixel 9, Pixel 9 Pro, Pixel 9 Pro XL, Pixel 9 Pro Fold, Pixel 9a
- Pixel 10 series: Pixel 10, Pixel 10 Pro, Pixel 10 Pro XL, Pixel 10 Pro Fold, Pixel 10a
- Other: Pixel Tablet, Pixel Fold
One detail worth pulling out of that list: the Pixel 6a and the whole Pixel 7 series are on it, even though those same models were left out of Google’s August 2026 stable security patch with no explanation. The beta track and the monthly stable patch are separate pipelines, so being skipped on one does not mean a device has dropped off the other. The Pixel 6 and 6 Pro, which Google has confirmed are at end of life, are absent from the beta list.
When the stable release lands
This is beta software on a Friday drop, arriving a week after Beta 2, and Android Police notes that unlike that release this one both fixes bugs and adds features rather than doing one or the other. Android Police puts the stable public rollout of Android 17 QPR2 in December this year, which is when the call-forwarding protections will reach Pixel owners who are not running beta builds.
If you are on the beta and would rather not be — bugs in the notification shade are exactly the sort of thing that wears thin on a daily driver — our guide on how to leave the Android 17 beta without wiping your Pixel walks through the timing that keeps your data intact.
Sources: 9to5Google, Android Police
