Android App Analyzer Flagged 17 Factory Apps — Here’s How to Triage the List

Factory reset done, Redmi Note 17 Pro Max 5G booted, Google account signed in — clean slate. So I installed Device Info: CPU & System (by Suryansh Prajapati) to run its App Analyzer over what Xiaomi ships on a fresh phone. Result: 17 of 458 apps flagged "At Risk" — 4 High, 11 Medium, 2 Low, 0 Critical.

That number sounds scary. It shouldn't. The real story is a split: 13 of the 17 flags are Xiaomi's own firmware apps, mislabeled by a scanner that equates "not from Play Store" with "sideloaded." The other 4 flags are genuine preinstalled third-party apps that came through a channel Google never reviewed. Sorting one group from the other is the whole game.

This post continues my Android security series and connects to the debloat guide:

1. 10 Criteria Before You Tap Install
2. Play Store Malware History
3. Auditing Preinstalled Apps That Survive a Factory Reset
4. Debloat Android Without Root — the removal method used below

What the analyzer actually checks

Per the Play listing, Device Info's App Analyzer breaks installed apps down by store, target SDK, last updated, and size. Its Permission Insights feature ranks apps holding each permission as High/Medium/Low risk, and its security scanner flags "risky app capabilities."

The exported PDF report shows the scoring rules in practice. Every flag traces back to one or more of four capability checks:

Plus one origin check — install source: System, Play Store, Other Store, or Sideloaded.

Here's the key detail: this is a capability scanner. It reports permissions an app holds, not code an app executes. That distinction decides which of the 17 flags are worth your time.

The 17 flags, verbatim from the scan

Report: 458 scanned, 441 clean, 17 flagged (Critical 0 / High 4 / Medium 11 / Low 2), generated October 12, 2026, on the freshly reset Redmi.

Look at the Source column. Zero flags came from the Play Store. Thirteen sit in "Sideloaded," four in "Other Store."

Why 13 of these flags are mostly noise

The "Sideloaded" label is wrong

Those 13 apps are firmware apps — Calculator, Clock, Notes, ShareMe, Gallery Editor. They live in the system image, return after every factory reset, and show install dates of January 9, 1970 (Android's epoch — the app never recorded a real install time because there wasn't one).

"Sideloaded" implies someone sideloaded them. Nobody sideloaded Calculator. The analyzer's source logic appears to be: not Play Store → not System → therefore Sideloaded. For a firmware app with no Play listing, that's a misclassification. And confusing factory bloat with user sideloading inverts the actual threat model: sideloading is a behavior you control, while preinstallation is a behavior the vendor imposed on you.

The permission reasons are the job, not the crime

• Mi Mover holds SMS + contacts access because its entire purpose is migrating data off your old phone. "SMS-fraud pattern" describes what a malicious app would want — here it describes the feature.
• Screen Recorder and Scanner draw overlay controls — the floating stop button is an overlay.
• Gallery Editor and Notes holding all-files storage is HyperOS's broad storage model, not exfiltration.
• Mi Store holding REQUEST_INSTALL_PACKAGES is, well, an app store installing apps.

This is the capability-vs-behavior trap my malware history post covers from the other side: the dangerous pattern is an app that acquires a permission it doesn't need for what it claims to do, then weaponizes it later. A scanner that scores raw permission presence will flag the most useful system apps hardest, because useful system apps do privileged things.

Scoring inflation is a feature, not a bug

A scanner that returns "0 issues" gets uninstalled. "17 at risk" gets a screenshot and a blog post (this one). Treat severity labels as prioritization hints from an amateur heuristic, not vendor-verified verdicts. Device Info is a one-person utility app, not a security firm — that's not a knock on it, just something to calibrate for.

The 4 flags that deserve action

The "Other Store" quartet — TikTok, Lazada, BingoPlus, WPS Office — is a different animal:

1. They're preinstalled third-party apps you didn't choose, present on a factory-reset device. That's the preinstalled threat class: one OEM review at ship time, then whatever the vendor's update channel does afterward.
2. They bypass Play review at install time. Whatever "Other Store" resolves to on this firmware (Xiaomi's GetApps channel, or a direct carrier/OEM push), these packages didn't pass Google's review process on this device.
3. They match the update-hijack pattern: stub app at factory, payload later, signing key held outside Google. ElcomSoft documented exactly this for preinstalled apps — and a factory reset doesn't clear it, it re-triggers it, because the preinstall channel reasserts itself.
4. They're the ones with install/overlay capability outside Play's update path. BingoPlus (a Philippine online gaming app, com.intech.c66app) and TikTok both hold overlay or install-package rights while living outside Google's review loop — that's a meaningfully larger attack surface than a flagged system Calculator.

Audit each one using the method from Part 3:

Settings → Apps → [app] → (menu) → App details in store

• Opens a Play listing → it's updatable and reviewable; decide if you want it at all.
• No listing → it's firmware-resident; search the package name for history before deciding whether to keep it.

Then remove what you don't use with the method from the debloat post: Shizuku + Canta, no root, no PC required. On HyperOS, these third-party preinstalls often show up in Canta with green or yellow badges, or can be uninstalled straight from the home screen like any ordinary user app.

Leave the red-badge core alone — phone, launcher, Play services. The flagged Xiaomi system apps are mostly harmless; either live with them or revoke individual permissions instead of removing them.

Cut the permissions, keep the apps

For the 13 firmware flags you're not removing, trim the actual risk surface — capability grants, not app presence:

• Settings → Apps → Permission manager — review storage access for apps you rarely use.
• Settings → Special app access → Display over other apps — revoke overlay from anything without a visible floating feature you recognize. This is the single highest-value cleanup from the whole list: overlay abuse is how ad-injection and phishing layers get placed on top of banking apps.
• Settings → Special app access → Install unknown apps — should be empty except your browser, and only temporarily.
• Settings → Security → Device admin apps — confirm nothing unknown holds admin rights.

Every flag on this scan falls under one of those four menus. No root, no ADB required for permission revocation.

Audit the auditor

Install a scanner to judge your apps, and you've added a new app to judge in turn. So I ran Device Info itself through the 10 criteria from earlier in this series:

Verdict: a reasonable diagnostic tool — use its output as leads, not verdicts. The PDF export staying on-device matters, because every scanner you install is one more app you're handing an inventory of your installed packages to. Trust the one that documents what it doesn't do.

The playbook

1. Scanner output is a triage queue, not a threat count. 17 flags doesn't mean 17 threats. Split by install source first: Play-reviewed vs. firmware vs. "Other Store."
2. Ignore firmware flags whose permissions match their function. Scoring on capability presence alone will always light up Calculator.
3. Act on non-Play preinstalls. That's where Part 2 and Part 3 predict real risk lives — you can't audit what Google never saw.
4. Revoke overlay and install grants you don't recognize. More valuable than uninstalling flagged system apps.
5. Remove bloat you don't use with Shizuku + Canta — reversible, no root, warranty intact.
6. Keep the baseline running: Play Protect on, auto-updates on, OS patched, unknown sources off, and a monthly sweep through Settings → Apps.

A factory reset clears your data, not the vendor's deals. A scanner can show you all the deals living in 458 apps — judgment decides which 4 are worth canceling.
Note: In my case I remove all '17 At Risk' and run the app analyzer again. There are so many bloatware which comes preinstalled that I don't needed and I removed it manually.

Sources: Device Info: CPU & System — Google Play · Developer privacy policy · Device Info PDF export, October 12, 2026 (scan data referenced throughout this post) · Google Play Protect · ElcomSoft — Android Pre-Installed Apps: What Could Possibly Go Wrong?

Last updated: October 2026.