com.sec.facatfunction Copy

Labelled "FacAtFunction", this is a Samsung-signed system package with no launcher entry, recorded here as not user-facing on every observation and with no Play-eligible observation. It carries a single Samsung OEM certificate that this site also records as signing the Android framework, a platform-level key. Samsung publishes no functional documentation for it, and descriptions circulating on APK catalogues and debloat lists are not a basis for a claim. What can be established is where it sits, and the requested permissions are the evidence. It requests com.sec.android.phone.permission.AT_COMMAND and com.sec.phone.permission.SEC_FACTORY_PHONE, five permissions in Samsung's com.sec.factory namespace (ALLOWFTCLIENTCPOBIND, BT_ID_WRITE, CAMERASERVICE, SIMDETEC and WIFI_ID_RESPONSE), and keystring permissions named for com.sec.android.app.lcdtest, com.sec.android.app.wlantest, com.sec.android.app.bluetoothtest, com.sec.android.app.servicemodeapp, com.sec.android.app.hiddenmenu and com.sec.android.app.phoneutil. Read together with the label, that places it in the same Samsung factory and engineering test family as the packages documented elsewhere on this site, on the AT command side of it. Two cautions belong with that reading: this site records the permissions a package requests, not the ones it declares, so which component defines each identifier is not established here; and requesting permissions named for other components suggests this package depends on them rather than the reverse. Its platform reach is the part a deployment review should notice. The aggregated set of 70 permissions includes MASTER_CLEAR and REBOOT, which the Android platform manifest defines at signature and privileged protection levels and marks as not for use by third-party applications, WRITE_SECURE_SETTINGS, which the same manifest describes as allowing an application to read or write the secure system settings, and alongside them DEVICE_POWER, CALL_PRIVILEGED, MODIFY_PHONE_STATE, READ_PRIVILEGED_PHONE_STATE, RECORD_AUDIO, CAPTURE_AUDIO_HOTWORD, MANAGE_EXTERNAL_STORAGE, INTERACT_ACROSS_USERS, DISABLE_KEYGUARD and identifiers naming Samsung's iris and fingerprint services. This site aggregates permissions across every observation of a package rather than presenting a per-build manifest, so nothing here dates any of them to a particular build. Builds observed range from roughly 14.4 MB to 21.8 MB. Published research gives the AT command surface its context, at the ecosystem level rather than for this package. The USENIX Security 2018 study of AT commands in the Android ecosystem extracted 3,500 AT commands from over 2,000 smartphone firmware images across 11 vendors and tested them against eight devices over the USB interface, characterising functionality that included rewriting device firmware, bypassing Android security mechanisms, exfiltrating sensitive device information, performing screen unlocks and injecting touch events, with no authentication required, and noting that charger mode and SELinux policies partially mitigate the threat. That study describes the interface class, not this package. For this package specifically the concrete evidence is its vulnerability record, and it is recent. Samsung's February 2026 security bulletin lists SVE-2025-2705 (CVE-2026-20981), improper input validation in FacAtFunction prior to SMR Feb-2026 Release 1, allowing a privileged physical attacker to execute arbitrary command with system privilege, affected versions Android 14, 15 and 16, with the note that the patch removes unused code; the NVD record scores it CVSS 3.1 base 6.6 with a physical attack vector. Samsung's May 2026 bulletin lists SVE-2026-0483 (CVE-2026-21019) at High severity, improper input validation in FacAtFunction in Galaxy Watch prior to SMR May-2026 Release 1, allowing a local attacker to execute arbitrary code with system privilege, affected versions Android Watch 14 and 16, with the patch adding proper check logic. Version note. The package does not appear in the Samsung Common Criteria mode application lists checked here for Android 9-era Galaxy S10+ (G975F) firmware or Android 11-era Galaxy S20 FE 5G (G781B) and Galaxy S20 Ultra 5G (G988W) firmware, and this site's earliest observation is on API 33, with observations spanning API 33 to API 37 and a target SDK roll-up of 33 to 36. Taken together that points to a component seen on recent releases rather than a long-standing one, with two caveats: absence from three device application lists is not proof of absence from the platform of that era, and when the package was introduced could not be sourced. The version naming also changes across the sample. The oldest build here by version code carries the version name 14 and the newest 1.1.54, so a dotted scheme appears in later builds where the earlier one used the Android major number; which release changed that, and why, could not be sourced. For Android Enterprise, EMM and kiosk fleets, treat security patch level as the control that actually matters: both findings above were addressed by Samsung maintenance releases, and a fleet held back on firmware carries them. The physical and USB dimension is worth a second look on shared, unattended and kiosk devices, since the first finding is scored with a physical attack vector. In the Android Management API the setting that addresses USB data reach is deviceConnectivityManagement.usbDataAccess: the reference defines DISALLOW_USB_DATA_TRANSFER as prohibiting all types of USB data transfers, supported on devices running Android 12 or above with USB HAL 1.3 or above and falling back to DISALLOW_USB_FILE_TRANSFER where it is not supported, while DISALLOW_USB_FILE_TRANSFER by itself disallows transferring files over USB and leaves other USB data connections such as mouse and keyboard permitted. Whether either setting closes the AT command interface in particular is not something the sources cited here establish, so treat it as reducing USB data reach generally rather than as a fix for this package. Beyond that, keep engineering and test components out of a kiosk allowlist unless they are needed and verify the finished build by trying to escape it. Samsung does not document what depends on this package, so disabling is rated caution rather than treated as a routine debloat target.

• core/res/AndroidManifest.xml (MASTER_CLEAR, REBOOT, WRITE_SECURE_SETTINGS) - Android platform source →
• ATtention Spanned: Comprehensive Vulnerability Analysis of AT Commands Within the Android Ecosystem (USENIX Security 2018) →
• CVE-2026-20981 (improper input validation in FacAtFunction) - CVE Program record →
• CVE-2026-20981 detail (CVSS 3.1 base score) - NIST National Vulnerability Database →
• CVE-2026-21019 (improper input validation in FacAtFunction on Galaxy Watch) - CVE Program record →
• Samsung Mobile security updates, February 2026 (SVE-2025-2705) - Samsung Mobile Security →
• Samsung Mobile security updates, May 2026 (SVE-2026-0483) - Samsung Mobile Security →
• Policies resource (deviceConnectivityManagement.usbDataAccess) - Android Management API →
• Galaxy S10+ LTE (G975F) application list - Samsung Knox CC Mode documentation →
• Galaxy S20 FE 5G (G781B) application list - Samsung Knox CC Mode documentation →
• Galaxy S20 Ultra 5G (G988W) application list - Samsung Knox CC Mode documentation →
• How do I prevent users from escaping kiosk (lock task) mode? - Jason Bayton →
• Package provenance for com.sec.facatfunction - Android System App Database →

• Signed by the device maker's own signing key (Samsung), so it is an OEM preinstall, and that single certificate is consistent across all 19 device profiles. It also signs the Android framework, so it is a platform-level key on its device(s). Inferred from the certificate appearing only on Samsung devices (508 packages, 10196 observations).
• Its largest observed manifest declares 70 permissions: 7 runtime (user-granted), 18 signature or system-level, 13 install-time and 32 vendor or uncatalogued.
• APK size ranges from 13.7 MB to 20.8 MB across the reporting device profiles, so the build differs substantially between them.
• Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.