com.samsung.android.networkstack Copy

Despite the bare name, this is not the NetworkStack module itself: devices report it as "NetworkStackOverlay", it carries no permissions, and this site records it at roughly 13 KB to 17 KB. That is the shape of a Runtime Resource Overlay (RRO), a resource-only package that changes the resource values of a target package at runtime without altering the target's code. The module it accompanies is documented separately on this site under the Google-signed name com.google.android.networkstack, and the AOSP-keyed sibling overlay under com.android.networkstack.overlay. What an overlay of this kind may set is published by the module itself. The NetworkStack module declares an overlayable named NetworkStackConfig, whose entries include the captive portal HTTP and HTTPS probe URLs (config_captive_portal_http_url, config_captive_portal_https_url) and their list forms, the fallback URL list, the DNS probe timeout, and the regular expressions used to decide whether a network validation probe succeeded or failed. AOSP's own configuration file is explicit that this is the supported route, noting that device makers wishing to change the captive portal URL configuration must set config_captive_portal_http_url rather than overlay the shipped default. Which of those values this particular Samsung build sets is not published and could not be sourced. Version note: NetworkStack is an updatable Mainline module, which AOSP describes as ensuring "that Android can adapt to evolving network standards", with updates to captive portal detection and login code specifically called out. This site's sample records the overlay with version names 12 through 17 and target SDK 31 to 37, so it has tracked recent releases; whether the values it overlays changed across those releases is not published and could not be sourced. Provenance: this site's sample records it only on Samsung devices, signed with Samsung certificates that are marked as also signing the framework, which fits an overlay built into Samsung's own firmware. For Android Enterprise, EMM and kiosk use it has no enrolment or policy role, but it is part of how the platform decides whether a network has working internet access. The captive portal probe URLs are the entry worth knowing about on a managed or filtered network, because they determine which endpoint the device contacts to make that decision. Disabling or removing the overlay does not harden anything; it discards the build's connectivity configuration and risks breaking network validation and the captive portal flow. Where kiosk mode is stopping a captive portal login from appearing, the supported fix is to allowlist the captive portal login app in the EMM application policy rather than to touch this package.

• Network Stack - Android Open Source Project →
• Change the value of an app's resources at runtime (RROs) - Android Open Source Project →
• NetworkStack overlayable.xml (packages/modules/NetworkStack) - Android source →
• NetworkStack config.xml (packages/modules/NetworkStack) - Android source →
• Kiosk devices and captive portals - Android Enterprise FAQ →
• Package provenance for com.samsung.android.networkstack - Android System App Database →

• Signed by the device maker's own signing key (Samsung), so it is an OEM preinstall, but 2 different certificates appear across the fleet, so OEMs ship their own builds of it. It also signs the Android framework, so it is a platform-level key on its device(s). Inferred from the certificate appearing only on Samsung devices (508 packages, 10196 observations).
• Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.