How to Inspect and Manage Default App Roles on Android Using ADB dumpsys role

Modern Android versions manage default applications and system privileges through the Role Manager subsystem (RoleManager). Unlike legacy Android releases where apps simply declared intent filters to become default handlers, the Android Role system defines structured, privileged system roles—such as Browser, Dialler, SMS, Home Launcher, Call Screening, Assistant, and Wallet. Gaining a system role grants specialized permissions automatically while revoking them if the role is transferred to another package. When provisioning enterprise devices, conducting security audits, or debugging default handler misconfigurations, Android Debug Bridge (ADB) allows administrators and developers to inspect and manipulate role assignments using dumpsys role.

Understanding the Android Role Manager Subsystem

The Role Manager service enforces strict security guarantees across Android:

• Single Role Holder: Most critical roles (such as android.app.role.DIALER or android.app.role.SMS) can only be held by a single application per user profile at any given time.
• Dynamic Permission Granting: When an application is assigned a role, Android grants all associated runtime permissions automatically (e.g. SEND_SMS and READ_PHONE_STATE) without prompting the user for individual permissions.
• Role Revocation: Transferring a role to a new package immediately strips those elevated permissions from the former holder.
• System Protected Roles: Certain roles (such as android.app.role.DEVICE_POLICY_MANAGEMENT or android.app.role.SYSTEM_GALLERY) are restricted to pre-installed platform packages or device administrators.

Connecting via ADB and Dumping Active Roles

Ensure your Android device has Developer Options and USB Debugging enabled, then connect via terminal:

adb devices

To inspect all roles and their current holder applications across all user profiles, execute dumpsys role:

adb shell dumpsys role

The command outputs a structured JSON or YAML-like list detailing every defined role, whether the role is available, and the package currently holding the role for each user ID.

Inspecting Common Default Role Assignments

To query which application holds a specific primary role for the main user (userId=0), filter the output:

To find the default web browser:

adb shell dumpsys role | grep -A 2 "android.app.role.BROWSER"

To find the default phone dialler:

adb shell dumpsys role | grep -A 2 "android.app.role.DIALER"

To find the default SMS handler:

adb shell dumpsys role | grep -A 2 "android.app.role.SMS"

To find the active home screen launcher:

adb shell dumpsys role | grep -A 2 "android.app.role.HOME"

The output explicitly shows: holders=[com.google.android.apps.messaging] or the corresponding package name.

Auditing Role Privileges and Fallback Handlers

The dumpsys role report also details fallback packages and default platform configurations:

adb shell dumpsys role | grep -A 10 "Default Roles:"

This displays which applications the device manufacturer or carrier designated as default out-of-the-box holders and whether third-party apps are permitted to request the role.

Managing and Changing Role Holders via cmd role

In addition to passive inspection via dumpsys, Android provides the interactive cmd role utility to manage role holders directly from the command line:

To list all available roles on the device:

adb shell cmd role list-roles --user 0

To query the current holder of a specific role:

adb shell cmd role get-bidi-role-holders --user 0 android.app.role.BROWSER

To assign a role to a new package programmatically (for example, setting Chrome or Firefox as the default browser):

adb shell cmd role add-role-holder --user 0 android.app.role.BROWSER com.android.chrome

To remove a role holder:

adb shell cmd role remove-role-holder --user 0 android.app.role.BROWSER com.example.oldbrowser

To clear all holders of a non-essential role:

adb shell cmd role clear-role-holders --user 0 android.app.role.CALL_SCREENING

Troubleshooting Role Assignment Errors

When scripting role assignments on Android, observe the following constraints:

• Manifest Intent Filters: An application cannot be granted a role unless its AndroidManifest.xml declares the appropriate intent filters and activities required by that role specification. If a package lacks the required manifest declarations, add-role-holder fails.
• Multi-User Isolation: Role assignments are scoped per Android user. When managing enterprise work profiles or private spaces, ensure you specify the correct --user <USER_ID> parameter (e.g. --user 10).
• Lockdown / Device Policy Restrictions: If a device is enrolled in MDM management, device policy controllers (DPCs) may lock role assignments, preventing changes via shell commands unless performed via device management APIs.