Android 17 QPR2 Beta 5 restricts programmatic call forwarding through USSD. UAE teams should check affected flows, handle the new failure response and move users into the dialler when required.
Android 17 QPR2 Beta 5, released on September 15, 2026, adds security restrictions around programmatic call forwarding. Android now parses call-forwarding USSD codes, such as `*21#`, and can block an app from running them in the background through `TelephonyManager.sendUssdRequest()`. The stated purpose is to reduce fraud and social-engineering attacks. (developer.android.com)
This is narrower than a general USSD ban. The Android release notes say that non-call-forwarding USSD requests, including mobile money transfers and account checks, are not affected by this change. The issue is specifically the use of USSD to enable call forwarding without a clear user action in the system dialler. (developer.android.com)
If your app silently turns on call forwarding, the operating system may now stop that step.
The practical question is not whether the company operates in the UAE. It is whether its Android app sends call-forwarding codes. This could matter to a telecom workflow, a customer-service application, a business phone tool or an app that helps a user route calls to another number.
A typical affected flow might look like this: a user chooses “forward calls to our support line”, the app builds a USSD string, and the app calls `sendUssdRequest()` while the user remains inside the app. On Android 17 QPR2, a standard app relying only on the `CALL_PHONE` permission can be blocked when it attempts a call-forwarding code in the background. Android reports the failure through the `USSD_ERROR_NOT_ALLOWED` callback. (developer.android.com)
That creates three business risks. The first is a failed setup flow, where the user believes forwarding has been enabled when it has not. The second is a support problem, because staff may see an Android update as an operator or SIM issue. The third is a control gap, if the app records success before Android confirms that the request was allowed.
The sensible response is to separate call-forwarding logic from other USSD logic. Do not assume that a working account-check or wallet flow proves that forwarding will still work. Test each use case independently.
Google’s stated mitigation is to use the `ACTION_DIAL` intent for call-forwarding setup when the app does not qualify for an exempted role. That lets the app pre-fill the device dialler, but the user must review and manually confirm the action. The app also needs to handle `USSD_ERROR_NOT_ALLOWED` gracefully rather than showing a generic success message. (developer.android.com)
For a UAE mobile app team, a sensible test sequence is:
The worked example is simple. If a customer-service app lets a user send `*21#` to forward calls, the old background request may now return `USSD_ERROR_NOT_ALLOWED`. The revised flow should open the dialler with the code ready, explain what the user is about to do, and treat the setup as incomplete until the user confirms it. This is the kind of change an Android app development team can isolate in a small compatibility test rather than rebuilding the whole product.
If the app only uses USSD for account checks, balance information or other non-call-forwarding actions, the Android release note says those requests are unaffected. There is no reason to redesign those flows merely because the QPR2 restriction exists. (developer.android.com)
There is also no reason to add a new permission simply because the old flow fails. The release notes describe the limitation as a restriction on call-forwarding codes when `CALL_PHONE` is the only permission available. The right fix is a tested user-confirmed route, or an applicable exempted role, not a speculative permission change. (developer.android.com)
For teams reviewing a payment or wallet application, this is best handled alongside the wider Android security review. Our earlier guide on AndroidX Security State checks for UAE payment apps covers a related testing mindset, but it does not replace testing the specific call-forwarding path.
Start with an inventory, not a platform-wide rebuild. If your app never enables call forwarding, record that finding and test the unaffected USSD journeys. If it does, reproduce the current flow on QPR2 Beta 5, add failure handling, and move the user to `ACTION_DIAL` where needed. Keep evidence of the test so customer-service staff know whether an Android failure, user cancellation or operator response caused the result.
The primary source is Google’s Android 17 QPR2 Beta 5 release note, dated September 15, 2026. Paknology has a commercial interest if this check leads to mobile-app changes or testing work, through its websites and mobile apps service. If your app is unaffected, the cheaper and simpler option is to document that result and leave the existing code alone, using your current developer or internal team for the test.
Book a free consultation and get a clear roadmap — from company formation to a fully automated digital operation.