android.auto_generated_rro_vendor__ Copy

The vendor-partition counterpart to android.auto_generated_rro_product__. It is an automatically build-generated Runtime Resource Overlay (RRO) that overlays the core framework package ("android") with resource values shipped on the vendor partition. RROs change a target package's resource values at runtime rather than modifying its code, and the "_vendor__" suffix records which partition this overlay lives on. AOSP applies overlays in a fixed partition precedence (system, then vendor, then ODM, OEM, product and system_ext), so a vendor overlay is overridden by a product overlay targeting the same resource; that precedence is why a device can carry both a "_vendor__" and a "_product__" overlay for the same framework target. On this site it is seen signed by Google and by several OEMs. It carries the vendor build's low-level framework resource customisations as a standalone package. It has no user interface and is managed by the overlay manager, not launched. For Android Enterprise, EMM and kiosk use it has no enrolment or management role. Disabling it would drop the vendor-level resource overrides, which can affect device configuration or appearance in hardware-specific ways, so treat it as caution and test on a single device before acting. Its presence and contents differ by vendor, build and Android version.

• Change the value of an app's resources at runtime (RROs) - Android Open Source Project →
• Package provenance for android.auto_generated_rro_vendor__ - Android System App Database →

• Re-signed by each device maker with its own platform key - 14 different certificates appear across 5 device makers in our sample. That is the signature of a stock AOSP/system package every OEM builds and signs itself, not a single maker's or a third party's preinstall.
• Its largest observed manifest declares 1 permissions: 1 runtime (user-granted).
• APK size ranges from 0.0 MB to 6.9 MB across the reporting device profiles, so the build differs substantially between them.
• Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.