Third Party App Molly Messager App installed as a System App

M3b4

I installed Molly Messager app on GrapheneOS as follows, GrapheneOS app store, Accrescent app store, Molly Messager but Molly installed as a "System App".
Should Molly have installed as a system app? No other third party messaging apps i.e Signal, WhatsApp installed as a system app so my concern is related to a third party app installing as a system app that would in turn have escalated system privileges.

Molly doesn't show up with the rest of my 3rd party apps installed in,
Security & Privacy Settings,
Privacy Control,
Permission Manager.

I have to tap top right hand corner 3 dots, Show System for Molly App to appear.
Molly App "Only" appears as a system app for
Contacts & Accounts
Location
Microphone
Nearby Devices
Network
Phone
Photos & Videos
Sensors

Molly App installed directly from Accrescent but yet Accrescent App Store is installed as a 3rd Party App Only under Permissions Manager. Signal, WhatsApp "All" appear as normal third party apps under Permission Manager.

Molly is also "Greyed Out" like system apps when checking Battery Usage per app in the Battery Section. Signal, WhatsApp are not greyed out. You can tap these app battery usage and directly open these apps but Molly you can't do anything. Its like the system apps which are all greyed out.

I checked and verified the SHA-256 both using App Verifier from Accrescent App Store and Github Mollyim repository.

SHA-256: 6aa80fdf4a8cc13737cfb434fc0cde486f09cf8fcda21a67bea5ee1ca2700886
https://github.com/mollyim/mollyim-android

Is Molly supposed to install as a system app which would escalate its privileges or as a normal third party app like Accrescent, Signal, WhatsApp?
Should I be concerned security wise that Molly is installed as a system app?
If Molly is "NOT" supposed to install as a system app then how did this happen?

I sent Molly a debug log. If you require the system log directly from my Pixel 9 with GOS I can forward on.

Kind regards

xxx

M3b4 Accrescent app store, Molly Messager but Molly installed as a "System App".

This is the real molly. So probably yes.

GrapheneOS

M3b4 It's not possible to add any additional system apps. It's a display issue for apps which aren't installed in Owner. It's completely normal that you can't configure settings for an app that's not installed in Owner from the Owner user. You don't have the app installed in the profile so it's not displaying as an installed app.

Fay_Wilmont

I'm not sure how this could happen. Without root it's not possible to install an app as a system app. Even system apps can't install other apps to the system partition as far as I know. They would get deleted anyway with the next firmware update.

Are you running a GrapheneOS fork instead of the official one? Did you buy your device with GrapheneOS pre-installed? Sounds like your "GrapheneOS" came with Molly pre-installed. In that case, you didn't install Molly from Accrescent, you updated it. Only explanation I can think of.

I tested installing Accrescent and then Molly on my phone with latest GrapheneOS, it got installed as a user app and listed like all the other user apps in the screens you mentioned.

AcclaimSublevel19

Fay_Wilmont I'm not sure how this could happen. Without root it's not possible to install an app as a system app. Even system apps can't install other apps to the system partition as far as I know. They would get deleted anyway with the next firmware update.

Yeah AFAIK this is true, system apps cannot be modified in any way. If you could do this I'd already know and would be hacking around! 😛

M3b4

I'm running GOS original.

My testing results below. Maybe someone else on forum can replicate on their end and report back to this thread.

Install any app directly from Accrescent App Store in the owner profile.
Use install available apps feature under Users and push these same apps from the owner profile to any other profiles in your pixel.
These apps that you push then install as system level apps and not third party apps.
Uninstall any one of these pushed apps then install the apk file for same app directly from github and then the app installs as a third party app.

Let me know if anyone can replicate on their own device.

M3b4

Was anyone able to reproduce with the
Molly App?

Pocketstar

M3b4 The Molly app is simply "visible" from within the primary profile if you also installed/pushed it to another profile.
You cannot remove an app that is installed on the secondary profile while you are currently on the primary profile and viewing the app from whitin the standard app list in settings, so it "appears" to behave like a system app which cannot be uninstalled but is still visible.
In this case, it is not actually installed as a system app and has no additional root privileges.
Perhaps this is what you meant instead?