Loading story…
Google released Android 17 QPR2 Beta 3 for supported Pixel devices, adding a new app-lock feature, broader interface customization, and several security changes. The update lets users require fingerprint or PIN re-authentication to open protected apps, expands theming and Quick Settings layout controls, and fixes bugs tied to notification and Quick Settings interactions that could trigger display problems or unexpected restarts, along with false battery-capacity warnings in device diagnostics.
The most significant security change targets call-forwarding scams by restricting apps from silently sending call-forwarding USSD codes through TelephonyManager.sendUssdRequest() with only the CALL_PHONE permission, while also adding an OS-level confirmation dialog when users manually enter call-forwarding codes in the system dialer. Google also expanded Mobile Network Security visibility with a timestamped SIM security timeline and details on cellular encryption ciphers, with signs that future alerts may cover downgrade, denial-of-service, jamming, and location-tracking threats.
See real exploitation activity before you spend the cycle.
6 events from the most recent confirmed update back to the earliest known activity.
Google had previously introduced expanded theming controls, including additional color styles and a broader color-selection slider, in the Android Canary channel. These customization options were later included in Android 17 QPR2 Beta 3.
An app-lock feature requiring fingerprint or PIN re-authentication to open protected apps appeared in an Android Canary build before being removed and later reintroduced in Android 17 QPR2 Beta 3.
Google fixed a bug in Android 17 QPR2 Beta 3 that caused display issues and unexpected restarts when opening notifications and Quick Settings. The release also resolved false reduced-battery-capacity warnings in the Device Diagnostics and Support tool.
Android 17 QPR2 Beta 3 expanded Mobile Network Security with a timestamped SIM security timeline and visibility into cellular encryption ciphers. Strings in the beta also indicated Google was preparing warnings for downgrade, denial-of-service, jamming, and location-tracking attacks.
Google added restrictions on call-forwarding USSD codes executed through TelephonyManager.sendUssdRequest(), blocking standard apps from silently running those codes in the background with only the CALL_PHONE permission and returning USSD_ERROR_NOT_ALLOWED for blocked attempts. Android also began showing an OS-level confirmation dialog when users manually enter call-forwarding codes in the system dialer.
Google released Android 17 QPR2 Beta 3 to supported Pixel devices, distributing build CP41.260731.005.A2 to Pixel 6a, Pixel 7 series, Pixel 7a, Pixel Fold, and Pixel Tablet, and build CP41.260731.005.B1 to other eligible models. The beta added interface customization changes, bug fixes, and security updates.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google has released **Android 17**, publishing the source code to AOSP under the tag `android-17.0.0_r1` and beginning rollout to supported Pixel devices, with broader availability planned across OEMs including HONOR, Lenovo, OnePlus, OPPO, vivo, Xiaomi, and others. Google also made **Generic System Images** available for `ARM64` and `x86_64`, while the platform adds major usability and device features such as foldable enhancements, App Bubbles, Handoff support, VVC/H.266 video, RAW14, HE-AAC, BLE hearing-aid improvements, and OpenJDK 25 integration. The release introduces a broad set of security and privacy changes, including tighter controls for **contacts**, **location**, and **local network** access, expanded one-time-password handling beyond SMS, stricter restrictions on **dynamic code loading**, stronger lost-device protections, improved threat detection, enhanced **Advanced Protection**, and stricter PIN retry limits. Google also added Certificate Transparency-related enhancements, support for **HPKE** cryptography and **ML-DSA** APK signatures, and continued restrictions on cleartext traffic, alongside Pixel-specific updates delivered through the June Pixel Drop.
Jul 12, 2026
Apple released an *iOS/iPadOS 26.4 developer beta* that adds **end-to-end encryption (E2EE) for RCS messaging** in limited testing, with availability constrained by device/carrier support and currently limited to **Apple-to-Apple** RCS conversations. The implementation is tied to upgrading to **RCS Universal Profile 3.0** built on the **Messaging Layer Security (MLS)** protocol, aligning with the GSMA’s prior move to standardize E2EE for RCS. The beta also expands platform hardening by allowing apps to opt into the full protections of **Memory Integrity Enforcement (MIE)** (beyond the previously available “Soft Mode”), and reporting indicates Apple may enable **Stolen Device Protection** by default in this release line. Google released the first *Android 17 beta* with multiple privacy/security changes aimed at tightening network and cryptographic defaults and improving user control. Android 17 **deprecates** the `android:usesCleartextTraffic` manifest attribute; apps targeting Android 17+ that set `usesCleartextTraffic="true"` without a **Network Security Configuration** will have cleartext traffic blocked by default, pushing developers toward more granular policy via configuration files. The beta also introduces a public **HPKE (Hybrid Public Key Encryption)** Service Provider Interface, adds user preference controls for **VoIP call history integration**, and expands **Wi‑Fi ranging** for proximity detection and secure peer-to-peer discovery.
Jun 29, 2026
Google has released a November feature update for Pixel phones, introducing several new capabilities focused on user security and convenience. Notably, the update adds scam detection for messages, which alerts users to potentially fraudulent communications, and notification summaries to help users manage important messages. These features are rolling out to Pixel 6 and newer devices, aiming to enhance protection against social engineering attacks and improve overall user experience. Separately, security researchers have disclosed a critical Android vulnerability known as Pixnapping (CVE-2025-48561), which allows malicious apps to capture screenshots of sensitive information without requiring special permissions. This flaw potentially exposes passwords, one-time codes, and financial data to attackers, affecting all modern Android devices, including those running the latest versions. While Pixnapping is not yet exploited in the wild, it underscores the ongoing risks to mobile device security and the need for prompt patching by Google.
Jun 29, 2026