com.knox.vpn.proxyhandler Copy

Shown on the device as "KnoxVpnPacProcessor", this is a Samsung-signed system component that ships as part of the Knox platform on Galaxy hardware. In our sample it is signed by the same Samsung key that signs the device framework, so it is an OEM component rather than anything a user or an EMM installs. Samsung documents PAC (proxy auto-config) support as a Knox feature: an administrator supplies the URL of a proxy auto-config file and Knox uses it to decide which proxy, if any, each request should go through. Samsung's Knox documentation describes this for global (all HTTP traffic), Wi-Fi and VPN scopes, with VPN being the only scope that can be narrowed to the container or to particular apps; global and Wi-Fi PAC settings apply device-wide. The Knox VPN framework itself also supports static HTTP proxies and PAC with several authentication schemes. We could not find Samsung documentation that names this package directly, so the component's precise internal role is inferred from its name and from the documented Knox PAC feature rather than stated by Samsung; treat the mapping as likely rather than confirmed. Android's own unrelated PAC helper, com.android.pacprocessor, is documented separately on this site. For Android Enterprise, EMM and kiosk use this matters if you push proxy or PAC configuration to Samsung devices through Knox Service Plugin or a Knox SDK integration. It has no launcher icon and nothing for a user to open. If your estate relies on Knox proxy or PAC settings, disabling it risks breaking that path. What it does on a device that receives no Knox proxy configuration is not documented by Samsung and we have not confirmed it, so do not assume it is inert. Because the exact dependency is unconfirmed, treat it as caution and test on a single device before changing it across an estate. Version note: Samsung merged the separate Knox VPN SDK into the main Knox SDK at Knox v3.4, and states that the old namespaces from the deprecated SDKs (including VPN) are no longer supported from the Android 10 (Q) release, so a VPN app still using the old com.sec.vpn namespace will malfunction on Android 10 and later. Knox PAC capabilities also vary by Knox version - Samsung lists manual proxy setup from v2.5.1, PAC over VPN from v2.5.1, and global and Wi-Fi PAC from v2.7.

• Knox PAC Support (Proxy Auto Config) - Samsung Knox Documentation →
• About Knox VPNs - Knox SDK, Samsung Knox Documentation →
• VPN namespace changes - Knox SDK, Samsung Knox Documentation →
• Package provenance for com.knox.vpn.proxyhandler - Android System App Database →
• Package provenance for com.android.pacprocessor - Android System App Database →

• Signed by the device maker's own signing key (Samsung), so it is an OEM preinstall, but 2 different certificates appear across the fleet, so OEMs ship their own builds of it. It also signs the Android framework, so it is a platform-level key on its device(s). Inferred from the certificate appearing only on Samsung devices (508 packages, 10196 observations).
• Its largest observed manifest declares 5 permissions: 3 signature or system-level and 2 install-time. The signature/system share marks it as a privileged component, not an ordinary app.
• Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.