com.qualcomm.wfd.service Copy

Reported on devices as "Wfd Service", this appears to be a Qualcomm component with no launcher icon in our sample, recorded on devices from CipherLab, Crosscall, Datalogic, Elo Touch Solutions, Fairphone, HMD Global, Lenovo, Nothing, OnePlus, Xiaomi, Zebra Technologies, isafemobile and Motorola. Where signer data is recorded it is signed with OEM keys this site attributes to the device makers, each of which also signs the Android framework, a platform-level key. No authoritative Qualcomm documentation reviewed for this note identifies the package or its implementation. Qualcomm does not document it by package name in the sources cited here. "WFD" is the usual abbreviation for Wi-Fi Display, the Wi-Fi Alliance specification certified as Miracast for mirroring a screen to a display over Wi-Fi, and its permissions fit that reading: it requests permissions to capture video output (including secure video output), to access SurfaceFlinger, to inject input events and to run a media playback foreground service. Its Wi-Fi Display role is therefore an inference from its name, label and observed permissions, not a documented fact. This site aggregates permissions across observations rather than per build, so which builds declare them cannot be established. Version note: in our sample it is recorded on devices running Android 9 to Android 16 (API 28 to 36), and this site's roll-up reports both its oldest and newest version as 2.0. Any change in its role across those releases could not be sourced. For Android Enterprise, EMM and kiosk use, no enrolment or management role is identified in the sources cited here. If it is the Wi-Fi Display service its name indicates, disabling it would be expected to stop wireless screen mirroring to Miracast displays on that device. That was not tested, so try it on one device of each model first.

• Miracast - Wi-Fi Alliance →
• Package provenance for com.qualcomm.wfd.service - Android System App Database →

• Re-signed by each device maker with its own platform key - 10 different certificates appear across 9 device makers in our sample. That is the signature of a stock AOSP/system package every OEM builds and signs itself, not a single maker's or a third party's preinstall. These are platform-level keys: they also sign the Android framework itself.
• Its largest observed manifest declares 13 permissions: 1 runtime (user-granted), 5 signature or system-level, 5 install-time and 2 vendor or uncatalogued.
• Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.