What the research found
A 2026 study out of Boston University analyzed 19.3 million app files spanning close to 6 million unique Android apps, tracking how permissions changed across app updates over time, then validated the findings on a real Android 16 device. Among apps that had multiple versions in the dataset, 17% gained new permissions inside a permission group the user had already approved, with no new prompt shown. Android groups related permissions together, and once you approve one permission in a group, the system auto-approves any later additions to that same group without asking again.
The researchers found this pattern showed up more in apps already flagged as malware by security scanners, at odds 35% higher than clean apps, rising to more than double the odds among the most permission-heavy apps. The study also identified 307 cases where one app’s custom-defined permission (a feature meant to let apps share data with each other) exposed contacts, text messages, location, login credentials, or medical records to an unrelated app, again with no prompt or visibility for the user at any point.
Why the first approval doesn’t mean what it feels like it means
When you approve a permission, the natural assumption is that you’ve made a specific, bounded decision: this app can access this exact thing. The permission-group system doesn’t work that way. Your one approval opens the door to an entire category, and anything else added to that category later walks through without asking again. A small pilot the researchers ran confirmed this happens under real conditions, not only in theory, tracking 23 separate permission expansions across 13 apps over about three months on one test device.
The practical takeaway
Review your phone’s app permissions through settings on a regular basis rather than assuming your original approval still reflects what an app can do today, since an update can expand that access without asking you again. Pay closer attention to apps that request broad permission groups up front (contacts, location, storage), since those are the categories where a later addition has the most room to happen. If an app you rarely open still holds sensitive permissions, revoking access is a safer default than leaving a standing approval in place for good.
This research documents a structural feature of how Android’s permission system has worked since its earliest versions, not a flaw unique to one app or developer. Apps vary in whether they take advantage of this gap, and the researchers note that manifest analysis alone overstates real risk, which is why they built additional bytecode analysis to separate apps that use expanded access from those that carry the permission without acting on it.
Reference
Akanji, O. A., Egele, M., Stringhini, G. “Silent Consent, Persistent Risk: Android Permission Groups and Custom Permissions.” arXiv, 2026. https://arxiv.org/abs/2605.27667
