com.google.android.networkstack.tethering Copy

The Tethering module, a Google-signed Project Mainline component that handles sharing the device's connection: Wi-Fi hotspot and USB, Bluetooth and Ethernet tethering. On a Google Mobile Services device it appears here as com.google.android.networkstack.tethering; the AOSP-keyed equivalent module is com.android.tethering. It is one of Android's connectivity Mainline modules, related to but distinct from the core Network Stack module above. Version note: the Tethering module (com.android.tethering) is in APEX format and shipped for devices on Android 11 or higher, so it can be patched through Google Play system updates independently of the OS. From Android 12 the module also took on core connectivity-service functionality. This is why it shows up as a standalone, separately versioned package rather than as part of the OS build, and the exact packaging varies by Android release and by whether the device uses Google or AOSP module keys. For Android Enterprise, EMM and kiosk use it is a system connectivity module, not an optional app, and it has no role in enrolment or management. Disabling or removing it would break hotspot and USB/Bluetooth tethering and is not a supported way to lock those features down. To stop end users sharing the connection, use the EMM's tethering and hotspot restrictions rather than interfering with this module.

• Tethering - Android Open Source Project →
• Mainline - Android Open Source Project →

• Signed by Google's own signing key (the same key Google uses across devices), so it is a Google-provided preinstall that updates independently of the system image, though 2 different Google signing keys appear across the fleet. This certificate spans 16 device makes - the hallmark of a globally distributed Google key.
• Its largest observed manifest declares 18 permissions: 3 runtime (user-granted), 11 signature or system-level and 4 install-time. The signature/system share marks it as a privileged component, not an ordinary app.
• Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.