com.sec.android.RilServiceModeApp Copy

Labelled "Service mode RIL", this is a Samsung-signed system package with no launcher entry, recorded as not user-facing on every observation here. RIL is the Radio Interface Layer, the telephony layer documented in AOSP's core connectivity material, so the name places this app on the modem and telephony side of Samsung's service and engineering tooling. It is the package already named, without explanation, in this site's note on com.sec.android.app.servicemodeapp: Samsung ships more than one service-mode component and does not document the split between them. What can be established beyond the name is its declared permission set, which is consistent with a privileged telephony test tool: MODIFY_PHONE_STATE, READ_PRIVILEGED_PHONE_STATE, WRITE_APN_SETTINGS, CHANGE_NETWORK_STATE, SET_DEBUG_APP, CLEAR_APP_USER_DATA, DEVICE_POWER and SYSTEM_ALERT_WINDOW, together with keystring permissions belonging to com.sec.android.app.factorymode, com.sec.android.app.hiddenmenu and com.sec.android.app.servicemodeapp. Those declarations are consistent with the dialler keystring family documented elsewhere on this site, but they record what this package declares rather than an established runtime relationship with those components. No published vulnerability naming this component was found in the CVE record, and Samsung publishes no functional documentation, so this note does not guess at the screens it presents. Version note. Samsung's application lists record it at version 9 on Android 9-era Galaxy S10+ firmware and 11 on Android 11-era Galaxy S20 FE and S20 Ultra firmware, and this site records builds from 12 through to 17, so the version has tracked the Android major version across five data points; that is Samsung's apparent convention rather than a documented rule. One version-linked detail is worth flagging: the permissions aggregated across observations here include android.permission.SATELLITE_COMMUNICATION, which the platform manifest defines as allowing an application to communicate over satellite and grants only to system or privileged apps. That indicates satellite-related test surface in at least some builds, but which build or Android release introduced it could not be sourced. The package is observed from API 28 through API 37 with no sign of being superseded. For Android Enterprise, EMM and kiosk use, the guidance matches the rest of this family. Its reach into APN settings and phone state is exactly the kind of surface a dedicated device should not expose, and where a build also makes service-mode screens reachable from the dialler that compounds it, so control it through the app allowlist and verify by trying to break out of the finished kiosk rather than starting from package removal. Samsung does not document what depends on it, so disabling is rated caution.

• RIL refactoring (Radio Interface Layer) - Android Open Source Project →
• core/res/AndroidManifest.xml (android.permission.SATELLITE_COMMUNICATION) - Android platform source →
• Galaxy S10+ LTE (G975F) application list - Samsung Knox CC Mode documentation →
• Galaxy S20 FE 5G (G781B) application list - Samsung Knox CC Mode documentation →
• Galaxy S20 Ultra 5G (G988W) application list - Samsung Knox CC Mode documentation →
• How do I prevent users from escaping kiosk (lock task) mode? - Jason Bayton →
• Package provenance for com.sec.android.RilServiceModeApp - Android System App Database →

• Signed by the device maker's own signing key (Samsung), so it is an OEM preinstall, but 2 different certificates appear across the fleet, so OEMs ship their own builds of it. It also signs the Android framework, so it is a platform-level key on its device(s). Inferred from the certificate appearing only on Samsung devices (508 packages, 10196 observations).
• Its largest observed manifest declares 26 permissions: 2 runtime (user-granted), 13 signature or system-level, 4 install-time and 7 vendor or uncatalogued. The signature/system share marks it as a privileged component, not an ordinary app.
• APK size ranges from 0.1 MB to 2.6 MB across the reporting device profiles, so the build differs substantially between them.
• Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.