- Find an app in the Google Play store
- Click on Install
- App is installed without any permissions granted, except for the default settings (SDK >= 23)
- Run the app without giving any extra runtime permissions
Now, what can the app know about me and my phone?
Severe exploits aside, can an invasive app use tricks to bypass limitations? Like web trackers adapted to use canvas fingerprinting and localstorage.
In Android 6.0 Marshmallow, applications will not be granted any permission at installation time. Instead, application has to ask user for a permission one-by-one at runtime.