com.sec.imslogger Copy

A Samsung component labelled "ImsLogger" on the device, packaged alongside the IMS stack above. It is signed by the same Samsung OEM keys that also sign the Android framework, has no launcher entry in our sample, and the builds recorded here run from 1.1.12.0 to 2.1.10.0 with target SDKs from 31 to 36. Its name and its pairing with com.sec.imsservice point to a diagnostic logging role for the IMS and VoLTE path, but Samsung publishes no documentation for it, so what it records, when it runs and where any output goes cannot be sourced. Nothing reviewed for this note establishes that it collects data continuously, and nothing establishes that it does not, so its runtime behaviour is best treated as unknown. For Android Enterprise, EMM and kiosk fleets it has no enrolment or management function. Administrators with a data-handling interest in on-device diagnostic logging may want to note its presence, but any decision to block it should rest on testing rather than on the name alone, since whether the IMS stack expects it to be present is undocumented. A safe-to-disable rating is omitted here for that reason.

• Implement IMS - Android Open Source Project →
• Package provenance for com.sec.imslogger - Android System App Database →

• Signed by the device maker's own signing key (Samsung), so it is an OEM preinstall, but 2 different certificates appear across the fleet, so OEMs ship their own builds of it. It also signs the Android framework, so it is a platform-level key on its device(s). Inferred from the certificate appearing only on Samsung devices (508 packages, 10196 observations).
• Its largest observed manifest declares 17 permissions: 2 runtime (user-granted), 6 signature or system-level, 5 install-time and 4 vendor or uncatalogued.
• Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.