Android 17 API 37: Breaking Changes Before the June Release

Android 17 Beta 4 is out—the last scheduled beta before stable lands in June. That matters because the API is now locked: no more behavior changes, no more grace periods. If your app uses LAN discovery, reads OTP messages from SMS, restricts orientation on tablets, or still depends on ExoPlayer 2, you are looking at broken functionality on devices running the stable release. Here is what you need to test and fix before June.

The Breaking Changes That Will Catch You Off Guard

Large Screen Layout Enforcement

This is the one that will hit the most apps. Starting with API level 37, Android ignores screenOrientation, resizeableActivity, minAspectRatio, and maxAspectRatio on displays wider than 600dp—that is, every tablet and foldable. Your app will fill the entire window regardless of what your manifest says. No pillarboxing, no opt-out.

The symptom is not always a crash. It is often subtler: a camera preview stretched sideways, buttons pushed off screen on a fold, or user state lost every time someone rotates a Pixel Fold. Google’s own tooling—Compose UI Check—can surface the worst issues, but you need to actually run on a large-screen emulator or device. The fix requires real work: adopt WindowSizeClass, handle configuration changes properly, and use Jetpack CameraX for camera. Flutter developers face the same requirement, with a dedicated breaking change note published by the Flutter team.

LAN Communication Now Requires a Permission

Apps targeting API 37 must declare and request the new ACCESS_LOCAL_NETWORK runtime permission (part of the NEARBY_DEVICES group) before doing anything on the local network—including mDNS browsing, raw socket connections, and device discovery. Chromecast integration, wireless printing, smart home device pairing, and peer-to-peer file transfer all require an explicit user grant.

There are two paths forward. The first: use the system-mediated pickers Android 17 provides—the media output switcher for casting and NsdManager‘s mDNS discovery picker for general connectivity. These skip the permission prompt but give you less UX control. The second: request ACCESS_LOCAL_NETWORK directly at runtime. IoT apps and smart home integrations will almost certainly need the explicit route. Either way, this is an architecture decision, not just a manifest edit. The official local network permission docs walk through both paths in detail.

Background Audio: ExoPlayer 2 Is Out of Time

Android 17 strictly enforces background audio restrictions for apps targeting API 37. Audio playback, focus requests, and volume changes from a non-visible app now require a foreground service using MediaSessionService. The legacy patterns—starting playback without a foreground service, or using the deprecated com.google.android.exoplayer2 library—will break. Media3 1.10 (stable since March 2026) is the current replacement. If you have not migrated from ExoPlayer 2 to androidx.media3, this is the forcing function. Google’s Media3 migration guide covers the full path.

Two Smaller Breaks Worth Fixing Now

OTP SMS delay: Apps targeting API 37 that read SMS directly will face a three-hour delay before OTP messages are accessible. Exemptions are narrow: default SMS apps, assistant apps, and apps using the SMS Retriever or SMS User Consent APIs. If your login flow reads SMS via SMS_RECEIVED_ACTION, migrate before June.

Static final reflection ban: Any code that uses reflection to mutate static final fields—common in testing libraries, analytics SDKs, and hook-based instrumentation—will throw IllegalAccessException on API 37, or crash outright via JNI. There is no workaround. Audit your dependencies and run your test suite against API 37 now.

New APIs Worth Adding to Your Roadmap

Post-Quantum Cryptography in the Keystore

Android 17 is the first Android release to support NIST-standardized ML-DSA (Module-Lattice-Based Digital Signature Algorithm) natively in the hardware keystore. For apps handling sensitive authentication—banking, healthcare, enterprise—this is worth evaluating now. Implementation uses the standard JCA APIs:

val generator = KeyPairGenerator.getInstance("ML-DSA-65", "AndroidKeyStore")
generator.initialize(
    KeyGenParameterSpec.Builder(
        "my-key-alias",
        KeyProperties.PURPOSE_SIGN or KeyProperties.PURPOSE_VERIFY
    ).build()
)
val keyPair = generator.generateKeyPair()

One caveat worth knowing: an ML-DSA-65 signature is roughly 3,293 bytes versus 64 bytes for ECDSA. If you sign tokens that ride in headers or QR codes, that size difference matters. Google’s post-quantum cryptography post covers the full rationale and the trade-offs in detail.

The Handoff API

Android 17 introduces a Handoff API that lets users resume an activity on a nearby device—continue reading on a tablet after starting on a phone, for example. Call setHandoffEnabled() on the activity, implement the onHandoffActivityRequested() callback, and the system handles synchronization via CompanionDeviceManager. It supports both native-to-native and native-to-web fallback. Worth a look if you build reading, productivity, or media apps.

Your Android 17 Migration Checklist

Before June, run through these six checks:

1. Test your app on a tablet or foldable emulator. Does it fill the screen without layout issues?
2. Grep your manifest and code for LAN socket connections or mDNS usage. Add ACCESS_LOCAL_NETWORK or switch to system pickers.
3. Search for com.google.android.exoplayer2 imports. Migrate to androidx.media3.
4. Check for SMS_RECEIVED_ACTION in your codebase. Migrate to the SMS Retriever API.
5. Set your build target to API 37 and run your test suite. Watch for IllegalAccessException.
6. Search your manifest for android:usesCleartextTraffic="true". Replace with a network_security_config.xml file.

The stable release lands in June. Beta 4 is the near-final testing environment—the last chance to catch regressions before users do. Google I/O 2026 is next week and Android 17 will feature prominently, but those announcements are for users. The API is already locked. Get your test suite running against API 37 now.