Here we go: weird package with redundant name found on running on my device.

tempproc

So I found this package com.google.android.ondevicepersonalization.services.OnDevicePersonalizationApplication running on my device and is not documented. The known package "com.google.android.ondevicepersonalization.services" is not supposed to be integrated in GOS in the first place, especially since it's problematic (uses user info for music music recognition, live caption and smart suggestions, none of which that I activated or want).

I have no GooglePlay sandboxing installed yet, and found this app with a weird naming that I can't disable or remove. I only used Aurora and F-Droid to install BBS and SaverTuner, did not give them any permission yet let alone used adb.

Is the device already compromised? What is this package, where does it potentially comes from and how did it get there if I can't disable it?

chinook

tempproc what is your exact build number, your release channel, phone model?
Does your phone pass the Auditor verification?

I have a phone WITH google services installed, and I don't have this package installed.

I do have, however, com.android.ondevicepersonalization.services.OnDevicePersonalizationApplication, which is apparently a part of AOSP.

Yours is weird -- can you provide more data?

Novalissoide

tempproc found this app with a weird naming that I can't disable or remove

This it seems may have got into their device in a, to support, unsafe way. I'm also unsure what Savertuner is doing there if only installed.
Tested installing now, and the first screen says it need:

adb shell pm grant --user 0 s1m.savertuner android.permission.WRITE_SECURE_SETTINGS

Byku

tempproc OP have you by chance mistyped the package name? Does it start with com.google?

fid03

tempproc especially since it's problematic (uses user info for music music recognition, live caption and smart suggestions, none of which that I activated or want).

How are you deducing that the app does that?

tempproc

chinook The phone seem to have pass the verification, im on stable 2025121201

The package can be found in Apps but there's no option to force stop, disable or uninstall suggesting its system.

fid03

chinook I have a phone WITH google services installed, and I don't have this package installed.

I do have, however, com.android.ondevicepersonalization.services.OnDevicePersonalizationApplication, which is apparently a part of AOSP.

Ditto on a 6a 2025121701 with sandboxed Google Play installed in Owner.

Novalissoide

tempproc
Is Developer options Off?
Have Adb, Shizuku or usb-debugging been used at any time, for any purpose?

Is bootloader re-locked?

Could you show us screenshots?

Novalissoide

tempproc Well, this is not what you wanted to hear, but you should salvage important files, backup any information that you need.

Factory reset.
Freshly install an OS of your choosing as per the officially recommended ways and means. If GrapheneOS, use without enabling Adb, Shizuku or Developer options.

Novalissoide

tempproc And if the habitual change gets to steep, get another device for guilty pleasures & experiments. Not your main device anymore.

Byku

Looks like I have it too. Pixel 7 Pro 2025121200. A quick glance in Rethink shows it has never connected to network.

Novalissoide

It's one of the system services that shows up as an 'app'. The full list shows in Settings > Apps > All apps -show system

App Verifier;
com.android.ondevicepersonalization.services
18:6C:57:F1:12:C4:19:0C:8E:48:2B:35:BA:11:EB:99:86:67:31:17:4F:DD:32:39:A5:73:44:46:A9:B5:83:67

Nothing to worry about.

chinook

Novalissoide yeah, you and me.

But the OP says they see com.GOOGLE.android.ondevicepersonalization.services.OnDevicePersonalizationApplication, not what we have.

Novalissoide

chinook thanks, missed that part at first. .

nologo

Novalissoide OP installed SaverTuner. From SaverTuner's Github page:

”Note that this app requires the WRITE_SECURE_SETTINGS permission that can be granted with EITHER a PC using ADB or root.”

Novalissoide

nologo good spotting. Thanks

tempproc

nologo I do not remember having gone through all the way in enabling those authorization for this app, but this could be the culprit. I'm going to blacklist F-Droid seeing as it doesn't seem to have any auditing of the apps they host even if they're popular downloads

fid03

Novalissoide

But the OP said they didn't use adb:

I only used Aurora and F-Droid to install BBS and SaverTuner, did not give them any permission yet let alone used adb.

Vomitorius

Have this crap too, pixel 9pxl

Vincent96

I have this too. Is it malicious?

Vomitorius

Vincent96 the silence anyone from gos is bothering me

Quantum

Vomitorius Yeah, its not like theyre busy doing other things. They havent even been tagged in the post.

GrapheneOS

tempproc com.android.ondevicepersonalization.services is a standard Android Open Source Project component which is part of GrapheneOS. If that's not present then you're not using GrapheneOS. The com.google prefixed name is used by the code internally and then there are 2 package names for the app itself with and without google based on whether it's the AOSP variant or their Google Mobile Services variant. This is the same approach as many other components. There's nothing special about this case.

Vomitorius Repetitive posts with baseless claims of compromise and fearmongering about standard Android Open Source Project system components don't need a response from the project every time. There are already plenty of threads about it. We'll just make it officially against the rules.

fid03 External package name and internal package name don't need to match. The external name is often set to com.android for AOSP by default and overridden to com.google.android for Google Mobile Services variants. The internal code can be either of those and it doesn't need to match.

tempproc

Byku No my bad it's a typo, it's com.android unless it's been modified which I don't think so

Vomitorius

Quantum browse all posts, they comment in most of them