Samsung Notes / Samsung Keyboard security escape path: disabled OEM apps accessible via kiosk bypass on Android (investigation pending)

Android

Title: Samsung Notes and Samsung Keyboard accessible in kiosk mode — disable and restrict OEM apps on Samsung tablets

On Samsung tablets enrolled in Esper kiosk mode, Samsung Notes (com.samsung.android.app.notes) and Samsung Keyboard (com.samsung.android.honeyboard) may remain accessible to end users even when both apps are set to Disabled in a blueprint. Users can reach these apps through unintended system-level pathways that bypass kiosk restrictions.

Why this happens

Samsung's One UI integrates certain OEM apps — including Samsung Notes and Samsung Keyboard — deeply into system services. These services can restore or surface the apps through input method prompts, clipboard actions, or text field interactions even after the Esper Agent has applied a Disabled state. Simply setting an app to Disabled in a blueprint does not always prevent Samsung system processes from re-invoking it.

Steps to resolve

1. Confirm the app Disabled state in the Esper Console.
   Go to Devices & Groups → [Device Name] → Apps and confirm that both Samsung Notes and Samsung Keyboard show a status of Disabled. If either app shows Enabled or Active, the blueprint has not applied correctly — continue to step 4 before proceeding further.
2. Verify the blueprint configuration.
   Go to Blueprints → [Your Blueprint Name] → Apps & Configuration and confirm that com.samsung.android.app.notes and com.samsung.android.honeyboard are both listed under Disabled Apps. If either is missing, add it, save the blueprint, and reapply before continuing.
3. Clear app data and cache using ADB.
   Even when an app is disabled, residual cached data can allow Samsung system services to re-surface it. Connect to the device via ADB and run:

   adb shell pm clear com.samsung.android.app.notes
   adb shell pm clear com.samsung.android.honeyboard

   Confirm both commands return Success.
4. Uninstall the apps for the active user if clearing data does not resolve the issue.
   Uninstalling for the current user removes the app from that user's profile without deleting the system package, which prevents Samsung services from relaunching it. Connect via ADB and run:

   adb shell pm uninstall -k --user 0 com.samsung.android.app.notes
   adb shell pm uninstall -k --user 0 com.samsung.android.honeyboard

   If either command returns an error, note the exact error message — it is needed for further troubleshooting.
5. Reapply the blueprint to the affected device.
   Go to Blueprints → [Your Blueprint Name] and confirm the Disabled Apps settings are correct. Then go to Blueprints → [Your Blueprint Name] → Apply to Devices, select the affected device, and confirm the reapplication. Allow 5–10 minutes for the device to fully converge to the new configuration.
6. Restrict the allowed input method in kiosk settings.
   If Samsung Keyboard remains reachable through text input fields, limiting the allowed keyboard to a non-Samsung alternative prevents it from being invoked by the system. Go to Blueprints → [Your Blueprint Name] → Kiosk Settings, locate the input method restrictions, and set the permitted keyboard to a managed alternative such as Gboard. Save and reapply the blueprint.
7. Collect a bug report if the issue persists.
   Go to Devices & Groups → [Device Name] → Actions → Request Bug Report. Once generated, download the report and review it for Samsung system services that may be re-enabling disabled packages — look for entries referencing com.samsung.android.app.notes or com.samsung.android.honeyboard in the package manager or activity manager logs.

Verify: After completing these steps, open the kiosk app on the device and attempt to trigger Samsung Notes or Samsung Keyboard through a text field or clipboard action. Neither app should launch or appear. The Devices & Groups → [Device Name] → Apps view in the Esper Console should continue to show both apps as Disabled within 10 minutes of blueprint reapplication.

If this doesn't resolve it

If Samsung Notes or Samsung Keyboard remain accessible after all steps above, the device's One UI version may be handling package management in a way that requires additional configuration. Before contacting Esper Support, collect the following:

• Device serial number and model
• One UI version and Android version (visible under Devices & Groups → [Device Name] → Device Info)
• Esper Agent version (visible in the same Device Info panel)
• The exact ADB error message from step 4, if any command failed
• The downloaded bug report from step 7
• A screen recording or description of the exact pathway used to reach the restricted app

Still need help?

If you're experiencing issues with Samsung Notes or Samsung Keyboard accessibility in kiosk mode, please submit a support ticket and include your device model, Android version, and specific steps to reproduce the bypass behavior you've encountered.