Can I get a virus from a browser that doesn't have storage permission?

Question

I am using Android 8.1.0 on an LML212VL LG Tracfone (more info at bottom). I downloaded the "DuckDuckGo Privacy Browser" app through the Google "Play Store" app. (This is the link I get when I click "Share" and "Copy to clipboard": https://play.google.com/store/apps/details?id=com.duckduckgo.mobile.android .) Later I went into the "Settings" app, and under "Apps & notifications", "App permissions", "Storage", I can see that DuckDuckGo's storage permission is disabled. (I don't remember if it was that way by default or if I did that, but I've kept it that way for most of the time I've had the app.) Also, within the "Settings" of the DuckDuckGo app, accessed via the menu at the top right, I have "Automatically Clear..." set to "Tabs and Data" and "Clear on" set to "App exit only".

Basically, I hoped to have a browswer set up so that it is not able to download anything that it doesn't delete on app exit, without asking for my permission in a specific way that I recognize. (Normally when I try to make an app do something I've denied it the permission to do, a certain type of pop-up appears, and I've made sure never to check the "Don't ask this again" box. When I try to download something in this DuckDuckGo app, the pop-up says "Allow DuckDuckGo to access photos, media, and files on your device?", and when I tap "DENY", a banner appears at the bottom of the screen saying "Downloading requires storage permission".) One problem, though, is that it clearly does keep a cache of some kind, since I can see it in the "Settings" app, under "Apps & notifications", "App info", "DuckDuckGo", "Storage". I sometimes delete the "cache". I think website language preferences and maybe autocomplete suggestions are kept in this "cache". I can also delete the "data" that the app keeps, but that undoes the settings I set within the app, tries to make me go through the introductory tutorial when I open it, and randomly tell me about how many things trying to track me it blocked ad it does the first time or so you use the app, so I don't do this as often.

My question is this: Does this mean that I can't possibly get a virus from a website through this app, even if I click on something suspicious, as long as I don't enable these permissions? Alternatively, does it mean that any virus I do get would be trapped 'within' the app in some sense and disappear when I close the app, when I clear the cache and data in "Settings", or at least when I delete and reinstall the app?

What made me worry about this is an event that happened some months ago while I was using this browser. I clicked on a link to some website or something, but it had apparently been replaced, and a pop-up appeared telling me that malware had been detected on my computer and that I needed to download something to scan for it and get rid of it or something. I didn't trust this at all, but for some reason I clicked "ok" to close the pop-up (I think I thought I needed to do that to close the tab without closing the app). As soon as I did this, the pop-up disappeared, and a loading bar appeared on the screen behind it with some text saying what it was supposedly doing (I think downloading something). I freaked out and immediately closed the whole app (which, remember, should clear tabs and data) and/or took the battery out of my phone.

I think I looked some stuff up on the internet using another device, but it didn't give me much peace, except telling me that what had just happened to me was a well-known scam to make people download malware and maybe suggesting that I use some supposedly more trustworthy malware-scanning app (I don't remember if I did, but, if so, I don't think it told me anything). When I turned my phone back on, I think I disabled "Wi-Fi" (and "Mobile data", but that was probably already disabled) in the "Settings" app, under "Network & internet"; then, I went into "Apps & notifications", "App info", "DuckDuckGo", and then probably clicked "Force Stop" and then "Uninstall", agreed that I really wanted to uninstall it, probably saw that it disappeared from both the "App info" list and my "App locker" (or whatever the place where clickable icons for every app are and that is down from the home screen is called), then (after re-enabling internet) reinstalled it through the Google "Play Store" app.

I don't have any particular reason to THINK I have malware on my phone (at least not anything that isn't usually on an Android phone), but there's not any way I understand that I can really be sure, except that I could be fairly sure if I factory reset my phone, and I don't want to do that. Thus, I'm wondering if I can at least be sure on logical grounds that I don't have any malware from that particular encounter or from any other site I went to with that browser.

As promised in the first paragraph here is the "more info at bottom" about my phone:

In the "Settings" app under "System", "About phone", "Hardware info":

• "Model number": "LML212VL" ("Up time", "S/N", "Wi-fi MAC address", and "Bluetooth address" are also given, but I don't think they would be helpful.)

Under ... "About phone", "Software info":

• "Android version": "8.1.0"

• "Android security patch level": "June 1, 2020"

• "Baseband version": "MPSS.JO.3.0.c12-00036-8937_GENNS_PACK-1.229846.1.264977.1"

• "Kernel version": "3.18.71"

• "Build number": "OPM1.171019.019"

• "Software version": "L212VL16g"

I can't guarantee that's what they were when the scare a few months ago I mentioned was, but it is what it is now, as of February 15, 2022.

Answer 1

If an app has storage permissions or not is totally irrelevant if it can be exploited or not (unless you download a malicious file your self). Attacks on web browsers usually use an exploit chain, a combination of multiple exploits:

1. The first exploit allows you to execute code with permissions of the web browser on Android.
2. Next one exploits a vulnerability of your OS to get full permissions (privilege escalation: leave the restricted app sandbox).
3. If necessary the last exploit then can give you root permissions, giving the attacker full access to everything (if step 2 has not already leveraged permissions to root).

For step 1 it is important to use a web browsers that is properly maintained, and updated regularly. But zer0-day exploits are discovered quite a few, e.g. for Chromium based browsers you have usually one zero-day vulnerability per month, often more.

Step 2 and 3 require an updated Android OS. As your phone is missing nearly two years of security updates there might be vulnerabilities for exiting the sand box and/or getting root.

In a general sense if there is a flaw in the browser runtime such as the javascript engine, or rendering engine and adversary could conceivably cause your browser to execute an arbitrary procedure as long as the OS allows it.