Android Security | 7 min read

7 Permissions You Should Never Grant an Android App

Most of what I see go wrong on people's phones traces back to a permission prompt they tapped "allow" on without reading. Here is what I actually check before installing anything.

Most Android risk starts at a permission prompt, not a headline-grabbing exploit.

The 7 permissions covered here

1. Accessibility Service
2. Device Admin
3. SMS access
4. Draw over other apps
5. Contacts, for apps that have no reason to need them
6. Background location, specifically the "always allow" option
7. Install unknown apps, granted to the wrong app

Android's permission system is genuinely good. The problem is not the system, it is how quickly people tap through prompts to get an app working, especially something they downloaded in a hurry to fix one specific problem. I have pulled apart enough malware samples and helped enough friends clean up their phones to have a short list of permissions that deserve real suspicion, not a reflexive "allow."

A quick note before the list: needing a permission is not automatically a red flag. A flashlight app asking for camera access makes sense, since it needs the flash hardware. The question is always whether the permission matches what the app is supposed to do, and whether you actually trust the developer behind it.

1Accessibility Service

This is the one I take most seriously. Accessibility Service was built for genuinely good reasons, screen readers, switch access, and other tools that help people with disabilities use their phone. But it also lets an app see everything on your screen and simulate taps and swipes on your behalf. That is effectively remote control of your device.

This is the exact permission behind most Android banking trojans documented by mobile security researchers, because it lets malware watch you type a password and then act as you, tapping through a money transfer while displaying a fake overlay on top. If an app you do not fully trust asks for Accessibility Service and its stated purpose has nothing to do with accessibility, decline it.

2Device Admin

Device Administrator access is meant for corporate mobile device management and things like Find My Device. It lets an app do things like force a factory reset, lock the screen, or change your password remotely. A legitimate use case is your company's MDM software. A suspicious use case is a random utility app asking for it with no clear reason. Apps with Device Admin are also notoriously hard to uninstall normally, since the permission has to be revoked first, which is itself a warning sign of how much control it hands over.

3SMS access

Full SMS read and send access lets an app read one-time passcodes sent by your bank, intercept two-factor authentication codes, and in the worst cases silently send premium-rate texts that show up on your phone bill. Legitimate reasons for an app to want this are much narrower than the number of apps that ask for it. Messaging apps and a handful of verification tools are reasonable. A game, a wallpaper app, or a flashlight app asking for SMS access is not.

4Draw over other apps

This permission lets an app display content on top of everything else on your screen, including other apps. It sounds harmless, and for things like a legitimate call-screening app or a floating chat head, it is. But it is also the mechanism behind tapjacking, where malware draws an invisible or convincing fake layer over a real app to trick you into tapping something you did not mean to, like approving a permission or confirming a payment while thinking you are tapping something else entirely.

5Contacts, for apps that have no reason to need them

A messaging or dialer app needing contacts access makes obvious sense. A calculator, a QR scanner, or a simple game does not. This one is less about direct device compromise and more about data harvesting, apps that quietly upload your entire contact list to build advertising profiles or, in worse cases, to fuel phishing campaigns against people you know. Check the permission against the app's actual job before granting it.

6Background location, specifically "always allow"

Android now separates "while using the app" from "always allow" for location, and that distinction matters more than most people realize. Very few apps have a legitimate reason to track your location when you are not even using them. Weather apps, fitness trackers with background route logging, and a small number of others qualify. Most apps asking for "always allow" location are doing it for ad targeting and behavioral profiling, not for a feature you actually asked for.

7Install unknown apps, granted to the wrong app

This permission lets a specific app install other APKs without going through the Play Store. It is reasonable for something like an alternative app store you deliberately chose to trust, such as F-Droid for open source software. It is a serious risk if it ends up granted to a browser, a file manager you barely use, or a messaging app, since that turns a single compromised or malicious app into a pipeline for installing anything else on your phone without your active involvement each time.

A simple habit that catches most of this

Before granting anything beyond the absolute basics, I open the app's permission page and ask one question: does this specific permission serve the feature I am trying to use right now? If the answer is not obviously yes, I decline and see if the app still works. A surprising number of apps ask for far more than they actually need to function, and Android will usually keep the core features working even if you say no.

Where to actually check and manage this

You do not need a third-party tool for most of this. Android's built-in permission manager, under Settings, then Privacy, then Permission manager, lets you see every app that has each type of permission, sorted by category rather than digging through each app individually. Google also documents the full permission model in detail on the official Android developer permissions guide, which is worth a skim if you want to understand exactly what each category unlocks. For a broader look at how mobile threats specifically abuse permissions like these, the ENISA threat landscape reports break down real-world attack patterns across the industry, not just Android.

None of these seven permissions are inherently malicious. Accessibility tools help people who need them, background location genuinely improves some apps, and Device Admin runs half the corporate phones in the world without incident. The risk is granting them by reflex, to an app that has no real reason to need them, just to get past a prompt faster. Slow down on these seven specifically, and you will close off the majority of ways a bad app actually does damage on Android.