Introduction

Android does allow apps to initiate package installation, but the operating system places strong limits on silent installs for security reasons. The practical answer depends on your environment: a normal app can usually launch an install flow that requires user approval, while silent installation is reserved for device-owner, affiliated profile-owner, or privileged scenarios.

The Usual Case: Start an Installation Flow

For ordinary apps, the simplest approach is to hand an APK to the package installer and let the user confirm the installation.

On modern Android, that usually means sharing the APK through a FileProvider and launching the installer with an intent.

1import android.content.Intent
2import android.net.Uri
3import androidx.core.content.FileProvider
4import java.io.File
5
6fun installApk(apkFile: File) {
7    val apkUri: Uri = FileProvider.getUriForFile(
8        this,
9        "${packageName}.fileprovider",
10        apkFile
11    )
12
13    val intent = Intent(Intent.ACTION_VIEW).apply {
14        setDataAndType(apkUri, "application/vnd.android.package-archive")
15        addFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION)
16        addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
17    }
18
19    startActivity(intent)
20}

This does not silently install the app. It opens the system installer UI, and the user still controls whether the install proceeds.

More Control with PackageInstaller

If you need a store-like or enterprise-style flow, use PackageInstaller. It lets your app create an install session, stream the APK into it, and then commit the session.

1import android.app.PendingIntent
2import android.content.Intent
3import android.content.pm.PackageInstaller
4import android.content.pm.PackageInstaller.SessionParams
5import java.io.FileInputStream
6
7fun installWithPackageInstaller(apkPath: String) {
8    val packageInstaller = packageManager.packageInstaller
9    val params = SessionParams(SessionParams.MODE_FULL_INSTALL)
10    val sessionId = packageInstaller.createSession(params)
11    val session = packageInstaller.openSession(sessionId)
12
13    FileInputStream(apkPath).use { input ->
14        session.openWrite("base.apk", 0, -1).use { output ->
15            input.copyTo(output)
16            session.fsync(output)
17        }
18    }
19
20    val callbackIntent = Intent(this, InstallStatusReceiver::class.java)
21    val statusReceiver = PendingIntent.getBroadcast(
22        this,
23        sessionId,
24        callbackIntent,
25        PendingIntent.FLAG_UPDATE_CURRENT or PendingIntent.FLAG_MUTABLE
26    ).intentSender
27
28    session.commit(statusReceiver)
29    session.close()
30}

In a real app, InstallStatusReceiver would be a BroadcastReceiver that reads the installer status from the callback intent extras.

The important restriction is that commit() may still require user intervention. The API gives you more control over package delivery, but it does not turn a regular app into a silent installer.

When Silent Install Is Actually Allowed

Android reserves silent install capability for tightly controlled environments. Examples include:

• device owner apps in enterprise management
• affiliated profile owner apps
• system or privileged apps on customized firmware

Outside those cases, the system intentionally keeps the final approval step with the user. That design prevents arbitrary apps from pushing other apps onto a device without consent.

Permissions and Unknown Sources

Apps that distribute packages outside a store may need the REQUEST_INSTALL_PACKAGES permission and may need the user to allow installs from that source. The exact user experience depends on Android version and device policy.

If your app tries to install from a raw file path without a FileProvider, newer Android versions will reject it. Secure content URIs are required for file sharing between apps.

Installation Is Not the Same as Visibility

Some workflows also need package visibility declarations to inspect whether another app is already installed. That is separate from the installation mechanism itself. Do not confuse "can I see packages" with "can I install a package".

Likewise, ADB-based installation commands are useful for development and device management, but they are not a general in-app installation strategy for production users.

Common Pitfalls

Expecting silent installation from a normal third-party app is the most common mistake. Android is designed to prevent that.

Using Uri.fromFile() on modern Android breaks because direct file URIs cannot be freely shared with the installer app.

Forgetting REQUEST_INSTALL_PACKAGES or the corresponding user approval flow can block the install path.

Assuming PackageInstaller always installs silently is incorrect. It often still ends in user confirmation unless the app has elevated management privileges.

Treating ADB or root-based solutions as ordinary production techniques leads to designs that only work on test devices.

Summary

• Normal Android apps can usually start an installation flow, not force a silent install.
• Use an installer intent for simple APK installs and PackageInstaller for more control.
• Silent installs are generally limited to device-owner, profile-owner, or privileged contexts.
• Share APK files through a FileProvider, not raw file URIs.
• Plan the UX around user approval unless you are in a managed enterprise environment.