com.android.smspush Copy

An AOSP platform component rather than an OEM addition, and one of the few packages on this site that carries no user-visible label at all: every observation here records it as the bare package name. Its source lives in the Android platform tree as packages/WAPPushManager, whose class documentation states that "The WapPushManager service is implemented to process incoming WAP Push messages and to maintain the Receiver Application/Application ID mapping", and that it runs as a system service. WAP Push is the binary SMS transport that carriers use to deliver messages such as MMS notifications and over-the-air configuration, so this is the component that decides which application, if any, handles a given push. It is optional by design, which is the single most useful thing to know about it. The telephony code that receives WAP push messages, WapPushOverSms, carries the comment that "Since WapPushManager is optional module, if WapPushManager is not found, legacy message processing will be continued", and that "If application ID is found, WapPushManager substitute the message processing". Where the manager is absent or has no registration for the application ID in question, the platform falls back to its ordinary behaviour: the message is delivered by intent to the default messaging application where one is set, or broadcast to registered receivers. MMS content is handled on a separate path from other WAP push types, under the RECEIVE_MMS permission rather than RECEIVE_WAP_PUSH. The manager also allows a registration to demand that the target package's signature is checked before it is launched. The provenance recorded here matches an AOSP component rebuilt by each vendor rather than a shared binary: it appears on 41 devices spanning 27 makes, including Zebra Technologies, Datalogic, CipherLab, Elo Touch Solutions, Fairphone, Crosscall, Sony, Xiaomi, Motorola, HMD Global, Lenovo, OnePlus and realme, and each is signed by that vendor's own key rather than one common key. It declares only QUERY_ALL_PACKAGES and WAKE_LOCK, which is consistent with a broker that looks up and starts other packages rather than doing the work itself. Version note: this is long-standing. Its manifest is present in the platform tree as far back as the Android 4.4.4 tag and the component is still in the current AOSP main branch, and devices here report it with platform-style version strings from 12 to 16, observed from API 27 through API 36 and targeting API 29 to 36. No source found here establishes a change in its role across Android releases, and none is implied by the data. Note this is not the same thing as the OMA client provisioning handlers that some vendors ship to act on the configuration messages WAP Push can carry; this package is the generic routing layer beneath that. For Android Enterprise, EMM and kiosk use it has no part in enrolment or policy and nothing a user can open. Its interest is as part of the inbound carrier-message path, which on a managed device is a route into the handset that the management channel does not control. The documented platform lever is not this package but policy: the Android Management API exposes smsDisabled, "Whether sending and receiving SMS messages is disabled". The rating below is caution rather than safe despite the AOSP comment that the platform continues without it, because on any given build a vendor or carrier application may have registered an application ID with it, and nothing here establishes what does so on your fleet. Removing it should be tested on one device, with MMS and any carrier-provisioning flows checked afterwards.

• WapPushManager.java (packages/WAPPushManager) - Android platform source →
• WapPushOverSms.java (frameworks/opt/telephony) - Android platform source →
• WAPPushManager AndroidManifest.xml at the android-4.4.4_r2.0.1 tag - Android platform source →
• Policy resource reference (smsDisabled) - Android Management API →
• Package provenance for com.android.smspush - Android System App Database →

• Re-signed by each device maker with its own platform key - 14 different certificates appear across 12 device makers in our sample. That is the signature of a stock AOSP/system package every OEM builds and signs itself, not a single maker's or a third party's preinstall.
• Its largest observed manifest declares 2 permissions: 2 install-time.
• Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.