com.sec.android.app.bluetoothagent Copy

Recorded on this site with the label "Bluetooth Agent", this is a small Samsung system component in Samsung's own Bluetooth namespace, seen only on Galaxy devices and across a wide range of them, from A-series handsets to flagship S-series, foldables and tablets. It is signed by a single consistent Samsung key that the site also records signing the framework package, so it is a platform component rather than an ordinary preinstalled app. It has no launcher icon and is not user-facing in any observation here, and the builds seen run to between roughly 128 KB and 440 KB. Samsung publishes no documentation for this package, and searching turns up only APK catalogue listings and community debloat lists, which are not authoritative and do not agree with each other. What the package actually does therefore could not be sourced, and the confident claims that circulate about it, in either direction, should not be relied on. What can be said rests on the provenance recorded here. It declares five permissions: RECEIVE_BOOT_COMPLETED, which Android documents as allowing an app to receive the boot-completed broadcast, though whether this package actually registers for it could not be established here; LOCAL_MAC_ADDRESS and MODIFY_PHONE_STATE, both of which Android treats as signature or privileged permissions rather than ones an ordinary app can hold; SYSTEM_ALERT_WINDOW, which allows drawing over other apps; and a package-private permission of its own, com.sec.android.app.bluetoothagent.permission.KEYSTRING, which Samsung does not document. Holding LOCAL_MAC_ADDRESS alongside a Bluetooth-flavoured name is consistent with something that reads the device's own radio identifiers, but that is an observation about the permission rather than a description of the feature. Version note: the version names recorded here run from "14" to "17", which tracks the Android platform release rather than a product version, against target SDKs from 33 to 37. That is the pattern of a component rebuilt with each platform release. Whether its role changed at any of those releases could not be sourced. For Android Enterprise, EMM and kiosk use, nothing in the Android Enterprise, Samsung Knox or EMM documentation refers to this package, and no evidence was found that it takes part in enrolment or policy. Because it is platform-signed and holds privileged permissions whose purpose is undocumented, disabling it could have Bluetooth-related or telephony-related effects that cannot be predicted from public sources, so it is safest left in place and only touched with careful per-device testing. If the aim is to control Bluetooth on managed devices, use your EMM's Bluetooth restrictions rather than disabling system packages.

• Manifest.permission (LOCAL_MAC_ADDRESS, MODIFY_PHONE_STATE, RECEIVE_BOOT_COMPLETED, SYSTEM_ALERT_WINDOW) - Android Developers →
• Package provenance for com.sec.android.app.bluetoothagent - Android System App Database →

• Signed by the device maker's own signing key (Samsung), so it is an OEM preinstall, and that single certificate is consistent across all 20 device profiles. It also signs the Android framework, so it is a platform-level key on its device(s). Inferred from the certificate appearing only on Samsung devices (508 packages, 10196 observations).
• Its largest observed manifest declares 5 permissions: 3 signature or system-level, 1 install-time and 1 vendor or uncatalogued. The signature/system share marks it as a privileged component, not an ordinary app.
• Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.