Silent Consent, Persistent Risk: Android Permission Groups and Custom Permissions

• URL: http://arxiv.org/abs/2605.27667v1
• Date: Tue, 26 May 2026 20:37:23 GMT
• Title: Silent Consent, Persistent Risk: Android Permission Groups and Custom Permissions
• Abstract summary: We conduct a longitudinal analysis of 19.3 million APKs spanning 5.97 million unique apps.<n>We identify cross-developer normal-custom-permission pairs that expose contacts, SMS, location, authentication credentials, user identity, and medical records to unrelated apps without any user prompt.<n>Our results show that consent erosion persists despite a decade of platform hardening and affects apps from obscure utilities to widely pre-installed software.
• Score: 15.033439629089402
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Android's permission system is designed to balance usability with informed consent, yet two legacy mechanisms still undermine that balance in Android 16: (i) permission groups that silently auto-grant new permissions within a group after a user's initial approval, and (ii) normal-level custom permissions that are auto-granted at install and enable cross-app access with no user visibility. We conduct a longitudinal analysis of 19.3 million APKs spanning 5.97 million unique apps (distinct package identifiers) from the AndroZoo repository, combined with on-device validation on Android 16. Among 2,244,575 multi-version apps, 381,026 (17%) silently gain permissions within already-granted groups. Using VirusTotal detections with primary threshold t=20, apps flagged as malware expand within groups at a higher rate than benign apps (odds ratio = 1.35, p < 0.001); the association holds across every tested threshold and concentrates in permission-heavy apps (OR = 2.06 in the top quartile). We also identify 307 cross-developer normal-custom-permission pairs that expose contacts, SMS, location, authentication credentials, user identity, and medical records to unrelated apps without any user prompt. A lightweight prototype built on public Android APIs recorded 23 silent expansion events across 13 apps during a 96-day single-device pilot, showing that update-time transparency is reachable without OS modification. Our results show that consent erosion persists despite a decade of platform hardening and affects apps ranging from obscure utilities to widely deployed and pre-installed software.

Related papers

• Lost in Permissions: Exploring the Microsoft 365 App Ecosystem [0.6719751155411074]
  We present the first privacy- and security-oriented measurement of M365 third-party applications.<n>We find that only 1,069 of them expose both descriptions and permission sets, with significant inconsistencies in transparency.<n>Overall, our findings expose systemic opacity and structural immaturity in the M365 app ecosystem.
  arXiv  Detail & Related papers  (2026-08-03T14:54:23Z)
• PrivacyAssist: A User-Centric Agent Framework for Detecting Privacy Inconsistencies in Android Apps [0.9892966978799635]
  This paper presents PrivacyAssist, a multi-agent LLM-based platform that detects inconsistencies between user-granted permissions and developers' declared sensitive data collection and sharing practices.<n>We evaluate PrivacyAssist with 200 users and 2,347 Android apps, finding that only 16% of apps are fully consistent between granted permissions and declared data practices.
  arXiv  Detail & Related papers  (2026-04-25T10:58:05Z)
• Do Phone-Use Agents Respect Your Privacy? [97.81424230136075]
  We introduce MyPhoneBench, a verifiable evaluation framework for privacy behavior in mobile agents.<n>We operationalize privacy-respecting phone use as permissioned access, minimal disclosure, and user-controlled memory through a minimal privacy contract.<n>Across five frontier models on 10 mobile apps and 300 tasks, we find that task success, privacy-compliant task completion, and later-session use of saved preferences are distinct capabilities.
  arXiv  Detail & Related papers  (2026-04-01T14:50:50Z)
• OpenApps: Simulating Environment Variations to Measure UI-Agent Reliability [49.99934595922838]
  Reliability is key to realizing the promise of autonomous UI-Agents.<n>We develop OpenApps, a light-weight open-source ecosystem with six apps.<n>We run more than 10,000 independent evaluations to study reliability across seven leading multimodal agents.
  arXiv  Detail & Related papers  (2025-11-25T19:00:22Z)
• Hey there! You are using WhatsApp: Enumerating Three Billion Accounts for Security and Privacy [1.4190701053683015]
  We show that WhatsApp remains highly vulnerable to enumeration at scale.<n>We probed over a hundred million phone numbers per hour without encountering blocking or effective rate limiting.<n>We also show that nearly half of the phone numbers disclosed in the 2021 Facebook data leak are still active on WhatsApp.
  arXiv  Detail & Related papers  (2025-11-25T12:27:05Z)
• Bamboo: LLM-Driven Discovery of API-Permission Mappings in the Android Framework [22.145558720584713]
  The official API documentation by Android chronically suffers from imprecision and incompleteness.<n>Recent efforts in improving permission specification primarily leverage static and dynamic code analyses to uncover API-permission mappings.<n>This paper introduces a pioneering approach utilizing large language models (LLMs) for a systematic examination of API-permission mappings.
  arXiv  Detail & Related papers  (2025-10-05T07:50:44Z)
• A Comprehensive Analysis of Evolving Permission Usage in Android Apps: Trends, Threats, and Ecosystem Insights [9.172402449557264]
  Despite official Android platform documentation on proper permission usage, there are still many cases of permission abuse.<n>This study provides a comprehensive analysis of the Android permission landscape.<n>By distinguishing between benign and malicious applications, we uncover developers' evolving strategies.
  arXiv  Detail & Related papers  (2025-08-04T02:54:10Z)
• On the (In)Security of Non-resettable Device Identifiers in Custom Android Systems [4.319029420721902]
  We present IDRadar, a scalable and accurate approach for identifying vulnerable properties and settings on custom Android ROMs.<n>We have identified 8,192 system properties and 3,620 settings that store non-resettable identifiers, with 3,477 properties and 1,336 settings lacking adequate access control.<n>Our large-scale analysis can identify a large number of security issues which are two orders of magnitude greater than existing techniques.
  arXiv  Detail & Related papers  (2025-02-21T07:52:46Z)
• Analysis of Longitudinal Changes in Privacy Behavior of Android Applications [79.71330613821037]
  In this paper, we examine the trends in how Android apps have changed over time with respect to privacy. We examine the adoption of HTTPS, whether apps scan the device for other installed apps, the use of permissions for privacy-sensitive data, and the use of unique identifiers. We find that privacy-related behavior has improved with time as apps continue to receive updates, and that the third-party libraries used by apps are responsible for more issues with privacy.
  arXiv  Detail & Related papers  (2021-12-28T16:21:31Z)
• Emerging App Issue Identification via Online Joint Sentiment-Topic Tracing [66.57888248681303]
  We propose a novel emerging issue detection approach named MERIT. Based on the AOBST model, we infer the topics negatively reflected in user reviews for one app version. Experiments on popular apps from Google Play and Apple's App Store demonstrate the effectiveness of MERIT.
  arXiv  Detail & Related papers  (2020-08-23T06:34:05Z)
• Mind the GAP: Security & Privacy Risks of Contact Tracing Apps [75.7995398006171]
  Google and Apple have jointly provided an API for exposure notification in order to implement decentralized contract tracing apps using Bluetooth Low Energy. We demonstrate that in real-world scenarios the GAP design is vulnerable to (i) profiling and possibly de-anonymizing persons, and (ii) relay-based wormhole attacks that basically can generate fake contacts.
  arXiv  Detail & Related papers  (2020-06-10T16:05:05Z)
• Decentralized Privacy-Preserving Proximity Tracing [50.27258414960402]
  DP3T provides a technological foundation to help slow the spread of SARS-CoV-2. System aims to minimise privacy and security risks for individuals and communities.
  arXiv  Detail & Related papers  (2020-05-25T12:32:02Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.