A system image is the packaged operating system and preinstalled software that ships on a device. On Android, it defines what is present before the user installs anything and often includes apps or components with elevated privileges. Because these files are part of the trusted base, ordinary uninstall tools and permission settings may not remove or control them.
In cyber security, the system image matters because compromise at this layer can survive normal app removal and can affect every later security decision. Attackers may abuse a tampered image to preload ad fraud, spyware, or other hidden behavior before first use. Defenders look for signs of supply-chain tampering, unsigned or modified system partitions, and unusual preinstalled packages. If the image is untrusted, a device may need a verified firmware update or full replacement to restore confidence.