Android 17 Development Features: What Developers Need to Know About API Level 37

Android 17 is out, and it changes how apps are expected to behave. Google released the stable build on June 16, 2026, starting with Pixel devices. It uses API level 37. If you build Android apps, some changes apply immediately, and others kick in once you raise your target SDK. This guide covers the main ones, based on Google’s official Android 17 developer documentation.

If you’re new to app development, start with our guide to the best programming languages to learn in 2026.

Android 17 Release Timeline

Source: Android Authority. Beta 3 was the platform stability milestone, where the SDK and NDK APIs were finalized, so you could target API 37 well before launch.

Behavior Changes That Affect All Apps

These changes apply when your app runs on Android 17, regardless of targetSdkVersion.

1. App Memory Limits

Android 17 introduces memory limits based on the device’s total RAM to keep the system more stable and predictable. The limits target memory leaks and other outliers before they cause UI stutter, battery drain or killed apps.

How to check whether your app was affected:

• Call getDescription on ApplicationExitInfo. If the limit hit your app, the exit reason is REASON_OTHER and the description contains “MemoryLimiter:AnonSwap”.
• Use trigger-based profiling with TRIGGER_TYPE_ANOMALY to collect heap dumps when the limit is reached.
• Test with adb: am memory-limiter status, ignore and manual let you inspect, bypass or impose limits on a process.

2. SMS OTP Protection Expands

Earlier versions mainly protected the SMS Retriever format. Android 17 extends the protection to WebOTP messages. If your app reads SMS to extract one-time passwords, move to the SMS Retriever or SMS User Consent APIs. Apps that can read SMS but aren’t the intended WebOTP recipient don’t get the message until three hours after it arrives.

3. Android Keystore Key Limits

The Keystore is shared by all apps, so Android 17 limits how many keys one app can own. The limit is 50,000 keys for non-system apps targeting API 37 or higher, and 200,000 for all other apps. Apps targeting 17+ get a new ERROR_TOO_MANY_KEYS error code. Avoid creating a new key per record or session.

4. Cross-Profile Loopback Traffic Blocked

Loopback traffic across profiles is no longer allowed by default. Traffic within the same profile is unaffected.

5. Keyboard Visibility After Rotation

If your app doesn’t handle a configuration change such as rotation, the previous keyboard (IME) visibility is no longer restored. If you want the keyboard to stay up, set android:windowSoftInputMode to stateAlwaysVisible or request it programmatically.

6. Touchpad Pointer Capture

If your app requests pointer capture and the user is on a touchpad, the system now recognizes pointer movement and scroll gestures and reports them as relative events. This mainly matters for games and tools used with laptops, tablets and Chromebooks.

Changes for Apps Targeting Android 17

These apply when you raise targetSdkVersion to 37.

• Lock-free MessageQueue: Apps targeting 17+ get a new lock-free MessageQueue implementation that improves performance and reduces missed frames, but may break code that reflects on private fields and methods.
• Static final fields: Apps targeting API 37 can no longer change static final fields.
• Content Capture: Calling setContentCaptureEnabled(false) no longer disables Content Capture.
• Bluetooth RFCOMM: BluetoothSocket read() behavior now follows standard Java InputStream behavior.
• Widget memory limit: Bitmaps and icons in a RemoteViews parcel have a strictly enforced memory limit.
• Cleartext traffic: Google says it plans to deprecate the usesCleartextTraffic element in a future release, so move to HTTPS now.

New Features and APIs

• MetricStyle notification template: Supports health and fitness, timers, stopwatches and travel use cases.
• New ProfilingManager triggers: Several new system triggers help you collect in-depth data to debug performance problems.
• Android Advanced Protection Mode (AAPM): A new set of security features for Android users.
• Constrained satellite networks: Helps apps work well over low-bandwidth satellite connections.

Developer commentary also points to a Compose-first direction, with Google building new APIs and tools exclusively for Jetpack Compose while classic View components move into maintenance. That’s from a secondary source, so confirm it in Google’s documentation before building a roadmap around it. Some Medium write-ups also mention items such as large-screen adaptive layouts, an EyeDropper API, and camera API changes. I couldn’t verify those against official docs, so I’ve left them out.

Android 17 Migration Checklist

1. Update compileSdk to 37 and test on an Android 17 device or emulator.
2. Profile memory use and fix leaks, then test with am memory-limiter.
3. Replace SMS parsing with SMS Retriever or User Consent.
4. Audit Keystore usage and avoid creating keys in bulk.
5. Search for reflection on MessageQueue and for edits to static final fields.
6. Test keyboard behavior after rotation.
7. Switch any remaining cleartext HTTP traffic to HTTPS.
8. Check widgets for large bitmaps and icons.
9. Raise targetSdk to 37 only after testing, since targeting changes behavior.

Security Takeaways

Many Android 17 changes tighten privacy and security: OTP protection, Keystore limits, loopback restrictions and Advanced Protection Mode. If you’re thinking about threat models more broadly, read our zero trust security guide and the post on AI-powered cyber attacks and how to prevent them.

Tools Worth Trying

Migrations like this are easier with a good coding assistant. See our roundup of the best GitHub Copilot alternatives in 2026. For more phone coverage, browse our Smartphones and Technology sections.