When an app asks for permission to access photo, media an files, does the andriod security model sandbox the access to only files for that particular app?

Or can the app then access files created by other apps?

So many apps ask for permission to the file system, does that mean e.g. App#1 can grab files created by App#2?

I want to install WeChat but want to understand what security risk is involved potentially.


1 Answer 1



Given that you mention the appearance of a popup asking for the permission to access the Storage, I feel safe to assume that your Android version be 6.0 or greater.

The Storage permission

The Storage permission gives an app access to the contents of the /storage/emulated/0 path. This means that an app would then be able to read and write any file under said location, be it created by you or any other app. It is worth mentioning that this permission does not allow for manipulating an external SD card.

In plain English, /sdcard tends to contain any file you download, any photo you shot, any music you listen to, and so on.

The internal data

Any installed app has a private directory containing its data. These directories are located at /data/data/, and are named after the package name of each app. Since any app is sandboxed by means of an user id and a group id, any app can only access the data it owns, and the previously discussed Storage permission has no effect whatsoever. These directories should concern no one but expert users, as they're vital for apps to work.

There is, of course, an exception. If your phone is rooted, any app requiring root privileges will potentially be able to read and write from and to any location in your device. This means that, if rooted, you should always have a filter such as Chainfire's SuperSU or Phh's Superuser to be notified when an app requests such privilege, in order to be able to deny it.

  • So whatsapp can read from wechat and visa-versa?
    – Blankman
    Sep 24, 2017 at 17:03
  • WhatsApp's unencrypted chats belong to the internal data. Encrypted backups of the chats are at /storage/emulated/0/WhatsApp/Databases/, and are unreadable by anything but WhatsApp. I do not know where WeChat stores its chats.
    – Grimoire
    Sep 24, 2017 at 18:15
  • any app can only access the data it owns, and also other apps' that share the same UID.
    – iBug
    Sep 25, 2017 at 13:18
  • @iBug Care to submit an edit?
    – Grimoire
    Sep 25, 2017 at 13:20
  • 1
    @DeathMaskSalesman That'd be overtly correct for a new user.
    – iBug
    Sep 25, 2017 at 13:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .