com.android.statementservice Copy

The "Intent Filter Verification Service", the StatementService component of the Android platform source. It is the agent that checks Digital Asset Links statements: when an app declares that it handles links for a domain, this service fetches the assetlinks.json file published by that domain and confirms the site vouches for the app. That check is what allows a verified Android App Link to open straight in the app instead of falling back to a browser or a chooser dialogue. It has no user interface. In our sample it appears across a wide range of makes and is signed by each build's own platform key, which is consistent with a platform component rather than a downloadable app. Version note: the surrounding verification model changed at Android 12. On Android 11 and lower the system would only make an app the default handler for its URL patterns if a matching Digital Asset Links file was found for every host in the manifest, whereas Android 12 introduced an updated verification process, in which verification can also be invoked manually for testing. Our sample shows the package holding both the older INTENT_FILTER_VERIFICATION_AGENT permission and the Android 12 DOMAIN_VERIFICATION_AGENT permission, which reflects that transition. For Android Enterprise, EMM and kiosk fleets it matters wherever links should land in a specific managed app. Single sign-on callbacks, enrolment and activation links, and deep links into line-of-business apps can all be built on verified App Links, though they may equally use a custom URI scheme or another routing mechanism that does not involve this service. Where a workflow does rely on verified App Links, disabling this package stops the verification requests being made, so a link that should open in a managed app can instead fall back to a chooser or a browser. There is no benefit to disabling it and a realistic chance of breaking link handling, so leave it in place.

• StatementService - Android (frameworks/base) source →
• Verify Android App Links | Android Developers →
• Package provenance for com.android.statementservice - Android System App Database →

• Re-signed by each device maker with its own platform key - 9 different certificates appear across 7 device makers in our sample. That is the signature of a stock AOSP/system package every OEM builds and signs itself, not a single maker's or a third party's preinstall. These are platform-level keys: they also sign the Android framework itself.
• Its largest observed manifest declares 13 permissions: 1 runtime (user-granted), 4 signature or system-level, 6 install-time and 2 vendor or uncatalogued.
• Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.