Android 16 QPR2: New Minor SDK Brings 3-Hour OTP SMS Delay & Icon Customization
Google has released the Android 16 QPR2 update, introducing substantial refinements across the interface, developer tooling, and system capabilities. This marks the platform’s first use of a minor-SDK mechanism, allowing new APIs and features to arrive not only in major annual Android releases but also through interim builds.
Minor SDK releases enable features to be added more quickly, with reduced risk to application compatibility. In QPR2, most changes are additive, while behavioral shifts focus mainly on security and accessibility — such as enhanced protection for one-time-password SMS messages and an expanded dark theme. To support this model, Android 16 introduces new fields in the Build class, allowing applications to verify both the primary SDK level and the minor version, and safely invoke additional APIs available only in QPR2.
On the user-experience front, Android 16 QPR2 brings new personalization and accessibility improvements. A strengthened dark theme is now available for users with low vision, light sensitivity, or simply a preference for darker interfaces. When enabled, Android analyzes the isLightTheme attribute and inverts the colors of core UI components — such as View, Jetpack Compose, and WebView — when needed. Applications that inherit from DayNight themes transition automatically; others are encouraged to define isLightTheme explicitly to avoid incorrect inversions. Google stresses that this is primarily an accessibility feature, not a substitute for a proper native dark theme, which remains essential for consistent design.
The home-screen experience also evolves. Users may now choose custom shapes for app icons, with the selected shape applying both to individual icons and folder previews. If a developer has not supplied a themed variant, the system can auto-generate one using color filtering. QPR2 also introduces categories within Quick Settings tiles: in edit mode, tiles are grouped by type, making it far easier to find specific functions and reducing clutter.
The system share sheet has likewise been enhanced. Applications may remain interactive while the system dialog is open and dynamically update the content being shared, enabling real-time adjustments such as refreshing available options or updating data without closing the sheet.
For developers, Google has expanded the Linux development environment within Android. Not only command-line utilities but also full Linux GUI applications can now run within the same terminal ecosystem. Android Runtime gains a new Generational CMC garbage collector focused on recently allocated objects, reducing CPU load and improving power efficiency. Widget interaction metrics — including clicks, scrolls, and impressions — offer developers deeper insight into how users engage with home-screen widgets.
A major area of engineering work concerns the ecosystem’s transition to 16 KB memory page sizes. Android 16 implements optimizations for thread-local storage that reduce memory usage on both 16 KB and traditional 4 KB page systems. QPR2 adds early warnings for debug applications not aligned with the 16 KB environment, issuing system notifications to help developers adapt their code and libraries before the architecture shift becomes widespread.
Media and connectivity also receive notable upgrades. Android 16 QPR2 introduces software decoding support for the Immersive Audio Model and Formats — an open spatial-audio standard — and integrates LE Audio personal audio sharing directly into the system output switcher. Within the Health Connect ecosystem, the system now computes step counts from device sensors and exposes them to applications with the appropriate permissions, offering simpler, more efficient tracking. Health Connect also expands support for additional metrics, such as weight and subjective training-load assessments.
To streamline migration between devices, Google has introduced a new Data Transfer API for third-party developers, designed to improve reliability when moving between Android and iOS and to minimize manual steps during device onboarding.
Privacy and security improvements in QPR2 are substantial. The system includes new APIs for verifying an app’s developer identity at install time and new ADB commands to emulate possible verification outcomes. Developers may still sideload their own builds via ADB without verification to test pre-release versions. Handling of SMS messages containing one-time passwords and autofill hashes has been redesigned: delivery to most applications is now delayed by three hours. During this period, the system withholds RECEIVE_SMS broadcasts and filters access to the SMS database, making interception of OTP messages significantly harder for attackers.
A major new platform-level safeguard is Secure Lock Device mode — a system status that can be activated, for example, via device-finding services. Once enabled, the device locks immediately; only the primary PIN, pattern, or password can unlock it. Notifications and lock-screen quick actions are concealed, and biometric authentication may be temporarily disabled for heightened protection.
Beyond user-facing features, Android 16 QPR2 includes a wide array of updates for OEMs and enterprise partners. The release ships with an updated Android 16 Compatibility Definition Document, refreshed Camera ITS tests, and expanded CTS Verifier suites covering Bluetooth MIDI, barometers, multi-device behavior, and Wi-Fi hotspot connectivity for Better Together scenarios.
In networking, Android 16 introduces a Bluetooth-based OS identification service that allows peripherals to detect an Android device’s API level and apply tailored optimizations. System APIs for IMS, emergency callback support, and traffic management for voice and multimedia calls have also been improved. Automotive OEMs gain enhanced APIs for Wi-Fi tethering, allowing them to retrieve lists of disconnected clients and the reasons for disconnection.
Google continues to refine haptic feedback as well. Android 16 adds standardized APIs for composing tactile effects, enabling developers to build consistent “primitives” — such as clicks or short vibrations — that behave predictably across devices without per-device tuning.
Significant attention has been dedicated to data privacy and hardening system components. QPR2 introduces a new SELinux macro restricting certain GPU driver system calls by filtering legacy and debugging IOCTLs from normal runtime contexts, reducing exploitability and strengthening system resilience. Personal Space receives usability improvements: users may now import files and photos directly into the private profile from the main profile via a dedicated “Add files” shortcut; the system then moves or copies them into the personal Downloads directory. Implementation remains OEM-specific but greatly simplifies isolating sensitive data.
In parallel with QPR2, Google continues improving seamless app updates and virtualization. A revised code-optimization sequence reduces the duration for which critical applications remain in a “frozen” state during updates — from seconds to mere tens of milliseconds. The Android Virtualization Framework gains enhancements for early VM startup, Microdroid updates, and support for 16 KB secure VMs — paving the way for isolating highly sensitive system components in hardened environments.
The final release of Android 16 QPR2 is now rolling out to Pixel devices not enrolled in beta or canary programs. Developers without physical Pixel hardware may use 64-bit system images in the Android Studio emulator. Beta participants who have not migrated to Android 16 QPR3 Beta may exit the program and receive the stable build over the air. To leverage the new capabilities, Google recommends using the latest canary builds of Android Studio Otter and monitoring the Android 16 and Android 16 QPR2 documentation on the developer site.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
