7 Dangerous App Permissions You Should Never Grant
Every Android app asks for permissions, and most requests are harmless. But some permissions hand an app the keys to your entire digital life: your messages, your location, your money, even control over your device. Knowing the dangerous app permissions you should never grant casually is the single most effective Android privacy skill.
This guide covers the seven most dangerous app permissions, what each one actually allows, which apps legitimately need them, and how to audit and revoke them across your phone. Treat any request for these as guilty until proven innocent.
Permission FAQ
What is the most abused permission? Accessibility access — intended for screen readers, abused by malware and aggressive adware to read screens and click ads. Grant it only to apps you deeply trust.
Can apps re-request denied permissions? Yes, and some nag persistently. Android 11+ auto-resets permissions for unused apps, and repeated denials lead Android to offer “Don’t ask again” — use it.
Do permission managers work? Built-in controls (Settings > Privacy > Permission manager) are sufficient. Third-party “permission manager” apps mostly duplicate system features while requesting invasive access themselves.
Permissions You Can Safely Revoke After Setup
Many apps ask for permissions during onboarding that they only need once. Navigation and ride-share apps ask for “precise location” but work fine on “approximate” afterward — change it under Settings > Apps > the app > Permissions > Location > toggle off “Use precise location.” Shopping apps that asked for camera access for a one-time barcode scan can have it revoked the same way. Android 12 and later even auto-resets permissions for apps you have not opened in a few months, but doing it manually is faster.
The permissions almost no app legitimately needs long-term: “Display over other apps” (used by screen-overlay scams), “Install unknown apps” (revoke it the moment your sideload is done — leaving it on is how drive-by installs happen), and “Modify system settings” (only automation apps like Tasker have a real case for this). One exception to be careful with: revoking “Alarms & reminders” breaks alarm-clock apps, and revoking background location breaks family-safety apps by design. When in doubt, set a permission to “Ask every time” for a week and see if anything actually breaks — usually nothing does.
1. SMS and Call Log Access (READ_SMS, READ_CALL_LOG)
dangerous app permissions illustration
What it allows: reading all your text messages and call history, and in some configurations sending messages.
Why it is dangerous: SMS contains password-reset codes, two-factor codes, and bank alerts. An app with SMS access can intercept the codes that protect your other accounts, enabling full account takeovers. This is among the most abused dangerous app permissions in banking trojans.
Who legitimately needs it: your default SMS app, and authenticator or backup apps you explicitly trust. Almost nothing else.
Rule: never grant SMS access to games, wallpapers, shopping apps, or utilities. If an app demands it to function and should not need it, uninstall.
2. Accessibility Services
What it allows: seeing everything on your screen, reading text from any app, simulating taps and swipes, essentially full remote control of your phone’s interface.
Why it is dangerous: accessibility access bypasses nearly every other protection. Malware with accessibility permissions can read banking app screens, enter credentials, and grant itself further permissions. It is the most powerful of all dangerous app permissions.
Who legitimately needs it: screen readers for visually impaired users, password managers for autofill, and automation tools like Tasker, all from developers you trust deeply.
Rule: if a random app asks for accessibility access, it is malware until proven otherwise. Google now restricts which apps can even request it, but sideloaded apps bypass those limits.
3. Device Administrator
What it allows: locking the screen, wiping the device, setting password policies, and critically, preventing its own uninstallation.
Why it is dangerous: malware uses device-admin status to make itself uninstallable and to lock victims out of their own phones in ransomware-style attacks.
Who legitimately needs it: corporate MDM systems on work phones, and reputable “find my phone” security apps.
Rule: no game, cleaner, or flashlight app ever needs this. If an app tricks you into granting it, revoke it in Settings, Security, Device admin apps before uninstalling.
What it allows: your exact GPS coordinates, accurate to a few meters, continuously.
Why it is dangerous: less immediately catastrophic than the above, but precise location history reveals your home, workplace, habits, relationships, and routines. Aggregated over time, it is one of the most intimate datasets that exists. It tops the list of dangerous app permissions people grant without thinking.
Who legitimately needs it: maps, navigation, ride-sharing, and delivery apps, while you are using them.
Rule: default every app to approximate location or “only while using the app.” Deny entirely for apps that do not need location at all: shopping, social, games, utilities.
5. Draw Over Other Apps (SYSTEM_ALERT_WINDOW)
What it allows: displaying content on top of every other app, including login screens and banking apps.
Why it is dangerous: this enables overlay attacks: a fake login screen drawn over your real banking app, capturing credentials as you type. It is a classic banking-trojan technique and one of the sneakier dangerous app permissions.
Who legitimately needs it: chat heads (Messenger bubbles), screen recorders, and blue-light filters.
Rule: grant only to well-known apps whose core feature requires overlays. A new app requesting it at first launch is a major red flag.
6. Microphone and Camera (RECORD_AUDIO, CAMERA)
dangerous app permissions illustration
What they allow: recording audio and capturing photos or video, potentially in the background.
Why they are dangerous: a surprising number of apps request these without needing them. Background recording is the stuff of spyware, and camera access can capture sensitive documents or surroundings.
Who legitimately needs them: camera apps, video calling, voice recorders, and QR scanners, scoped to “only while using the app.”
Rule: set both to “Ask every time” or “Only while using the app” for everything. Watch for the green status-bar indicator; if the mic or camera activates unexpectedly, investigate immediately via Privacy Dashboard.
7. Full Storage and “All Files” Access (MANAGE_EXTERNAL_STORAGE)
What it allows: reading every file on your phone: photos, documents, downloads, backups, everything.
Why it is dangerous: your storage contains the unencrypted residue of your life. Apps with full access can harvest photos for facial recognition datasets, steal documents, and exfiltrate backups.
Who legitimately needs it: file managers and backup apps from trusted developers.
Rule: prefer Android’s photo picker, which grants access to selected images only, over full storage access. Deny “all files” access to social, shopping, and utility apps.
Honorable Mentions: Handle With Care
Contacts access: feeds spam and social-graph harvesting. Deny unless the app’s core function is communication.
Calendar access: reveals your schedule and meetings. Rarely needed.
Body sensors: health apps only, from developers you trust.
Install unknown apps: granting this to a browser or chat app opens the sideloading door. Enable temporarily, then disable.
Notification access: lets apps read all notifications, including message previews and codes. Grant only to trusted utilities.
Honorable Mentions: Handle With Care
Contacts access: feeds spam and social-graph harvesting. Deny unless the app’s core function is communication.
Calendar access: reveals your schedule and meetings. Rarely needed.
Body sensors: health apps only, from developers you trust.
Install unknown apps: granting this to a browser or chat app opens the sideloading door. Enable temporarily, then disable.
Notification access: lets apps read all notifications, including message previews and codes. Grant only to trusted utilities.
Real-World Abuse Cases: Why These Permissions Top the List
These are not theoretical risks. Dangerous app permissions have been exploited in documented incidents:
Banking trojans via accessibility. Malware families like Anatsa and TeaBot abused accessibility services to overlay fake login screens on banking apps, stealing credentials from thousands of victims. The attack starts with a sideloaded app requesting accessibility access for a fake “update.”
SMS interceptors and 2FA theft. Trojaned apps with SMS permission silently forwarded two-factor codes to attackers, enabling account takeovers even with 2FA enabled. This is why authenticator apps (which do not use SMS) are safer than SMS codes.
Stalkerware via location and microphone. Commercial spyware marketed as “parental control” or “employee monitoring” abused location, microphone, and message permissions to surveil victims, disproportionately women. Google and security vendors now flag these apps, but sideloaded variants persist.
Overlay phishing. Apps with draw-over permission displayed pixel-perfect fake banking logins atop real apps. Victims typed credentials into the attacker’s screen.
Every one of these attacks required the victim to grant a dangerous app permission. The permission prompt was the last line of defense, and it failed because users tap “allow” reflexively. Understanding dangerous app permissions means understanding that the prompt is a security decision, not an annoyance to dismiss.
How to Audit Dangerous App Permissions on Your Phone
Do this quarterly, or right now:
Go to Settings, Privacy, Permission manager.
Tap each high-risk permission: Location, Camera, Microphone, SMS, Call logs.
For every app listed, ask: does this app’s function require this? If not, change to “Don’t allow” or “Ask every time.”
Check Settings, Apps, Special app access for Device admin apps, Draw over other apps, and Accessibility. Remove anything you do not recognize or trust.
Check Privacy Dashboard for a 24-hour timeline of actual sensor usage.
What to Do When an App Demands a Dangerous Permission
Legitimate apps explain why they need access and work with reduced functionality if you decline. Illegitimate ones pressure you:
“This app won’t work without SMS access” from a wallpaper app: uninstall.
Repeated permission prompts after you denied: the app is nagging; consider replacing it.
Feature hostage-taking: “grant contacts access to continue” from a calculator: uninstall and find an alternative.
Permission escalation after updates: an app that worked fine for a year suddenly demands accessibility access in an update deserves immediate scrutiny and usually removal.
Remember: you can always grant later if a feature genuinely needs it. Deny first, evaluate, then decide.
Permissions and Kids’ Devices
Children grant every permission every app requests. On kids’ devices, pre-configure permissions yourself, use Family Link to approve installs, and deny the dangerous app permissions categories above by default. Review quarterly; kids install new games constantly, and each one is a fresh permission negotiation.
What are the most dangerous app permissions on Android?
SMS/call-log access, Accessibility services, Device Administrator, precise location, draw-over-other-apps, microphone/camera, and full storage access. These seven can expose messages, money, location, and device control.
Should I ever grant accessibility access to an app?
Only to well-established apps whose core function requires it: screen readers, reputable password managers, and automation tools from trusted developers. Never to games, cleaners, or apps you just installed from outside the Play Store.
Why does a flashlight app want my contacts?
It does not. That request is for data harvesting or worse. This is the textbook example of dangerous app permissions abuse: the request has no relationship to the function.
Can I revoke permissions after granting them?
Yes, anytime: Settings, Apps, select the app, Permissions. Revoking never harms your phone; at worst, a feature stops working until you re-grant.
Do iPhone apps have the same permission risks?
iOS has a similar permission model with comparable risks, though Apple’s review is stricter and sideloading is restricted. The audit habit matters on both platforms.
How often should I audit app permissions?
Quarterly for most users, monthly if you install apps frequently, and immediately after installing anything from outside the Play Store.
Conclusion
Dangerous app permissions are not dangerous in themselves; they are powerful tools that become dangerous in untrustworthy hands. SMS access in your messaging app is fine. SMS access in a game is an attack.
The rule is simple: deny by default, grant by exception, and audit regularly. Fifteen minutes in Permission manager today closes holes you did not know were open, and the quarterly habit keeps them closed. Your apps work for you, not the other way around.
Qamar Abbas is the founder and CEO of Qamar Digital Ventures LLC, a New Mexico-based web design and SEO agency. He writes hands-on, research-backed guides about Android apps, APK guides and mobile how-tos for a US audience, tested on real devices and updated regularly.
What do you think?
Share your experience or ask a question. A useful conversation starts with you.
Join the discussion