Google Play services for Instant Apps downloads/installs itself without authorization, downloads/updates other components, how to disable? Background
&quot;Google Play services for Instant Apps&quot; has installed itself onto my device without my permission. It broke functionality of my firewall (AFWall and couple of other apps). And it is updating itself and other apps/components without permission.  When I uninstall this component, it downloads itself again and installs right back. (That is, most likely it is &quot;Google Play services&quot; that's actually doing this in the background)
There are no confirmations and no notifications of anything downloading, updating, or installing. The way I discovered it was by noticing that some functionality of my apps was changed/broken. So I used an app (&quot;System Info for Android&quot;) and it shows that in fact this &quot;Google Play services for Instant Apps&quot; was installed a day ago.
My question is: how do I completely disable unauthorized updates of an Android device, yet preserving the following functionality:

Contacts Sync
Google Play Store
Google Maps App

In these screenshots, you can see that all settings responsible for automatic updates are switched off. Therefore this download and installation is clearly unauthorized and should not be happening. The screenshot of Instant Apps setting shows up after the thing is already installed. Leaving just the global setting from Google Play Store.

Settings › Apps // Settings › Google › Instant Apps (turned OFF!) // Play Store Settings (Auto Update turned OFF!)
It has all started after I followed a misleading suggestion, you can see in this screenshot, to update &quot;Google Play services&quot;:

click image for larger variant

Update 1:
What I've discovered so far is that something (most likely &quot;Google Play Services&quot;) is requesting the download + install. The way it's doing it is placing the request with Google Download Manager. Unclear what triggers it, but if watching device closely an icon from Download Manager does show up in notification indicating download percentage. However, upon completion, it instantly disappears. Still, there is nothing indicating installation.
What I've tried so far:

Install the following as user-level instead of system-level apps that they are originally: Google Account, GP Store, and Service Framework  (com.google.android.gms; com.android.vending; com.google.android.gsf) This didn't work. The download is still requested and subsequently, installed.
Seems any way of blocking installation will make it download again and again (until your data is used up). So most likely best approach would be to prevent the downloading in the first place. I wasn't able to install Download Manager as a user app, which seems the part that needs to be controlled.
Blocking Download Manager and/or Play Store via firewall is possible, but that breaks down the only trustworthy way of downloading apps.

Update 2:
Downgrading to the previous version of GP Services (v11.3.02) worked for a few days, but today GP services for Instant Apps was downloaded and installed. So, doesn't matter which version you use. Most likely Google will update all phones this way regardless.
Update 3:
So now Google is updating itself on regular basis pretty much whenever it feels like it. If I'm streaming a movie, crippling my speed, using up my internet bandwidth for which I pay money per MB. In this image you can see 3 Google apps were updated without permission.
Update: In recent android versions you can do it from Settings -> Google -> Instant Apps -> OFF.


  Original answer follows below:


In the best case scenario this should be enough to block Instant Apps from auto-updating.

Run on device via a terminal (connectbot, juicessh, etc).



pm hide com.google.android.instantapps.supervisor


Or, if running via adb on a pc while connected via cable (or wifi adb), then use:

adb shell pm hide com.google.android.instantapps.supervisor


Unlike pm disable pm hide also works on non-rooted devices. So far, I didn't see any more Instant Apps notifications appearing.

If the above does not work for you then another approach would be modifying the SELinux context of the file/folder (e.g. with chcon).



To revert the pm hide command above use:

pm unhide com.google.android.instantapps.supervisor