8

I am seeing this popup displayed occasionally over more than one app (in this image, it is appearing over my calendar app).

"Install now to control when your device updates. Your device will automatically install the update and schedule a restart. (Learn more) -> Install now"

This appeared on a Google Pixel 6 Pro, which is updated to the latest Android 12. It appears without any prompting action on my part, which makes me suspicious. Furthermore, it doesn't identify itself as a system popup.

I'm extremely suspicious of this and I'm wondering if anyone else has seen it in the wild.

10
  • 1
    You can try this app and see if it is able to find out which app is creating that dialog. You'll have to set it up and wait for it to observe the dialog. Alternatively, you can setup adb and whenever that dialog shows up use your PC to issue this adb command: adb shell dumpsys window windows > dump.txt. Share the file with us. Another alternative is to take a bug report whenever that dialog shows up and then from that report share only the relevant part with us (dumpsys windows).
    – Firelord
    Aug 11, 2022 at 21:29
  • 2
    Previously posted on Stack Overflow. Ryan M (who was an Android employee at the time of writing) commented that "these strings are present in the Google Play Services codebase for the update functionality, so while I personally haven't seen that exact screen, I would believe it's real."
    – Andrew T.
    Aug 12, 2022 at 2:42
  • Kind of related with similar looking dialog from Google Play Services: How can I disable the "Install update to keep device running smoothly" notification?
    – Andrew T.
    Aug 12, 2022 at 2:51
  • 3
    It may be true that these strings are present in the Google Play Services codebase, but if I was a clever malware writer, I'd use them for precisely that reason. The point is, the dialog doesn't tell me anything about what I'm being asked to install. It doesn't come up in the context of updating my device. It randomly pops up when I have regular old apps running. These three points make me very suspicious of this dialog. Aug 12, 2022 at 18:23
  • 1
    @PatrickBrennan it's been over a year and I see no answers here. Did you get a satisfactory resolution? I'm seeing the same popup and my 2-minute Google search suggests it's probably nothing serious but I'm wondering if you discovered anything nefarious? Oct 1, 2023 at 0:42

1 Answer 1

2

Google Play Services shows that popup.

Ryan M (an employee of Google/Android at the time of writing) commented:

[...] these strings are present in the Google Play Services codebase for the update functionality, so while I personally haven't seen that exact screen, I would believe it's real.

However, this doesn't really help the user to determine whether the popup they see is legit or not.


Eli Billauer posted a detailed explanation about preventing the Android system update on his website, including the popup. Quoting the relevant parts on how to check who is responsible for the popup (log output is trimmed for brevity):

Who’s behind the popup window?

The first step is to figure out what package initiates the request for an update.

[...]

Now some hands-on. When the popup appears, go

$ adb shell dumpsys window windows > dump.txt

That produces a lot of output, but there was this segment:

  Window #10 Window{28d0746 u0 com.google.android.gms/com.google.android.gms.update.phone.PopupDialog}:
    [...]
    mOwnerUid=10146 showForAllUsers=false package=com.google.android.gms appop=NONE
    [...]
    mBaseLayer=21000 mSubLayer=0    mToken=ActivityRecord{577992f u0 com.google.android.gms/.update.phone.PopupDialog t26}
    mActivityRecord=ActivityRecord{577992f u0 com.google.android.gms/.update.phone.PopupDialog t26}
    [...]
    WindowStateAnimator{9e9cbdf com.google.android.gms/com.google.android.gms.update.phone.PopupDialog}:
      mSurface=Surface(name=com.google.android.gms/com.google.android.gms.update.phone.PopupDialog)/@0x223f02c
      [...]

Also, in the output of

$ adb shell dumpsys > all.txt

there was a much more to-the-point section saying (pretty much at the beginning of this huge file):

Display 4619827677550801152 HWC layers:
---------------------------------------------------------------------------------------------------------------------------------------------------------------
 Layer name
           Z |  Window Type |  Comp Type |  Transform |   Disp Frame (LTRB) |          Source Crop (LTRB) |     Frame Rate (Explicit) (Seamlessness) [Focused]
---------------------------------------------------------------------------------------------------------------------------------------------------------------
 [...]
---------------------------------------------------------------------------------------------------------------------------------------------------------------
 com.google.android.apps.nexuslaunche[...]exuslauncher.NexusLauncherActivity#0
  rel      0 |            1 |     DEVICE |          0 |    0    0 1440 3120 |    0.0    0.0 1440.0 3120.0 |                                              [ ]
---------------------------------------------------------------------------------------------------------------------------------------------------------------
 [...]
---------------------------------------------------------------------------------------------------------------------------------------------------------------
 com.google.android.gms/com.google.android.gms.update.phone.PopupDialog#0
  rel      0 |            1 |     DEVICE |          0 |   48  698 1392 2511 |    0.0    0.0 1344.0 1813.0 |                                              [*]
---------------------------------------------------------------------------------------------------------------------------------------------------------------
 StatusBar#0
  rel      0 |         2000 |     DEVICE |          0 |    0    0 1440  145 |    0.0    0.0 1440.0  145.0 |                                              [ ]
---------------------------------------------------------------------------------------------------------------------------------------------------------------
 NavigationBar0#0
  rel      0 |         2019 |     DEVICE |          0 |    0 2952 1440 3120 |    0.0    0.0 1440.0  168.0 |                                              [ ]
---------------------------------------------------------------------------------------------------------------------------------------------------------------
 ScreenDecorOverlay#0
  rel      0 |         2024 |     DEVICE |          0 |    0    0 1440  176 |    0.0    0.0 1440.0  176.0 |                                              [ ]
---------------------------------------------------------------------------------------------------------------------------------------------------------------
 ScreenDecorOverlayBottom#0
  rel      0 |         2024 |     DEVICE |          0 |    0 2944 1440 3120 |    0.0    0.0 1440.0  176.0 |                                              [ ]
---------------------------------------------------------------------------------------------------------------------------------------------------------------

This is much better, because the window in focus is clearly marked. No need to guess.

Another place to look at is

$ adb shell dumpsys activity recents > recent.txt

Where it said:

  * Recent #0: Task{51b5cb8 #26 type=standard A=10146:com.google.android.gms U=0 visible=true mode=fullscreen translucent=true sz=1}
    userId=0 effectiveUid=u0a146 mCallingUid=u0a146 mUserSetupComplete=true mCallingPackage=com.google.android.gms mCallingFeatureId=com.google.android.gms.ota_base
    affinity=10146:com.google.android.gms
    intent={act=android.settings.SYSTEM_UPDATE_COMPLETE flg=0x10848000 pkg=com.google.android.gms cmp=com.google.android.gms/.update.phone.PopupDialog}
    mActivityComponent=com.google.android.gms/.update.phone.PopupDialog
    [...]
    Activities=[ActivityRecord{577992f u0 com.google.android.gms/.update.phone.PopupDialog t26}]
    [...]

This is interesting, as it says which Intent and Activity stand behind the popup, just by asking what the last Activity requests were. Even more important, if the popup was dismissed or disappeared for any other reason, it can still be found here.

So no doubt, it’s com.google.android.gms that stands behind this popup. That’s Google Mobile Service, and it’s a package that is responsible for a whole lot. [...]

Under the section “ACTIVITY MANAGER PENDING INTENTS (dumpsys activity intents)” there was

    #8: PendingIntentRecord{50a35f1 com.google.android.gms/com.google.android.gms.ota_base broadcastIntent}
      uid=10146 packageName=com.google.android.gms featureId=com.google.android.gms.ota_base type=broadcastIntent flags=0x2000000
      requestIntent=act=com.google.android.chimera.IntentOperation.TARGETED_INTENT dat=chimeraio:/com.google.android.gms.chimera.GmsIntentOperationService/com.google.android.gms.update.INSTALL_UPDATE pkg=com.google.android.gms (has extras)
      sent=true canceled=false

which I suppose indicates that com.google.android.gms has requested to run its own .update.INSTALL_UPDATE at a later stage. In other words, this is the indication of the recurring request to run the INSTALL_UPDATE intent.

Thus, if com.google.android.gms/.update.phone.PopupDialog appears in the log output, then it should be a legit popup from Google Play Services. Otherwise, the package name of the offending app will also be shown.

3
  • Thanks Andrew. Is your conclusion that this intrusive popup is a cryptic message (incredibly bad UX by Google) indicating that the Google Play Services is planning to update itself (even though the message itself gives no such information to the user)? It still seems unclear what is actually getting updated. Eli has demonstrated that the message likely comes from GMS, but as Eli mentions, "it's a package that is responsible for a whole lot". Can we conclude that it is planning on updating itself? Oct 1, 2023 at 8:25
  • BTW, the second link in your answer goes to a deleted page on StackOverflow. I checked on Wayback Machine, and the page is not present there either. Do you know if that page is available elsewhere? Oct 1, 2023 at 8:27
  • @RockPaperLz-MaskitorCasket based on the package name of the caller com.google.android.gms.ota_base and the download size (2.03 GB) from the screenshot on the blog, looks like it's about the Android system update OTA, not Google Play Services (GPS can and does update itself without the user's intervention). As for the deleted SO post, I'm not sure if there's an archive of it, but AFAIR that's the only comment that was related to this matter, before that question got closed and deleted (it's a cross-post that's off-topic on SO).
    – Andrew T.
    Oct 1, 2023 at 10:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .