com.android.compos.payload Copy

Recorded on devices as "CompOS", this is an AOSP platform component rather than an app. It is the payload APK for Compilation OS, the isolated compilation feature of the Android Virtualization Framework (AVF). AOSP describes isolated compilation as using a protected virtual machine as a software secure enclave, so that the bootclasspath and system server JARs from an updated APEX are compiled before a reboot instead of during early boot, which cuts the boot time that follows a platform module update. The compilation itself runs inside Microdroid, the small Google-provided Android OS that AVF boots in a protected VM. In the Android source it is built as CompOSPayloadApp, and its manifest declares the package com.android.compos.payload with android:hasCode="false" and the label CompOS, so it packages assets for the virtual machine rather than code that runs on Android itself. It ships inside the com.android.compos APEX. In our sample it has no launcher entry, requests no permissions, is only a few tens of kilobytes, and is signed by a range of different device makers' keys rather than by one Google key, which is what a component rebuilt into a platform APEX on each device looks like. Version note: AOSP states that AVF is supported only on ARM64 devices, and our sample records this package with target SDK 35 to 37 and platform version names of 15 to 17, so it appears on recent releases rather than older ones. Its location in the Android source moved between the Android 14 and Android 16 trees, from compos/apk to build/compos/CompOSPayloadApp, while the package name and manifest stayed the same, so that is a source reorganisation rather than a change of role. For Android Enterprise, EMM and kiosk use it has no enrolment, policy or user-facing role, and administrators will only meet it in an app inventory. There is nothing to gain from disabling it, and interfering with it risks affecting isolated compilation and so the boot time after a module update, so it is best left in place.

• Android Virtualization Framework (AVF) overview - Android Open Source Project →
• AVF use cases, including isolated compilation - Android Open Source Project →
• CompOSPayloadApp AndroidManifest.xml, Android 16 source - Android (packages/modules/Virtualization) →
• CompOS payload AndroidManifest.xml, Android 14 source - Android (packages/modules/Virtualization) →
• Package provenance for com.android.compos.payload - Android System App Database →

• Re-signed by each device maker with its own platform key - 10 different certificates appear across 8 device makers in our sample. That is the signature of a stock AOSP/system package every OEM builds and signs itself, not a single maker's or a third party's preinstall. At least one observed build is signed by a third-party (carrier or partner) certificate.
• Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.