Permissions decide what an app is allowed to reach on a device, from the camera and location to contacts and storage. Most are routine, but some reach sensitive data, and an app that asks for more than it needs creates both security and privacy risk. This explains what app permissions are and which ones deserve a closer look.
What app permissions are
An app permission is a grant of access to a device feature or to data. Some are given automatically because they are low-risk. Others, the sensitive ones, need the user to approve them, usually with a prompt the first time the app needs them.
Which permissions are considered dangerous
Android calls the sensitive ones dangerous permissions. iOS handles the same idea through prompts and entitlements. The common high-sensitivity ones include:
| Permission | Why it is sensitive |
|---|---|
| Location | Reveals where the user is and where they have been. |
| Camera and microphone | Can capture the user's surroundings and conversations. |
| Contacts | Exposes personal data about other people, not just the user. |
| Storage / photos | Access to files and media the user did not necessarily mean to share. |
| SMS and call logs | Highly sensitive on Android, and often abused by malware. |
Why asking for too much is a problem
Every permission an app holds is something an attacker can use if they compromise the app, and something a third-party SDK inside the app may quietly use too. Asking for more than the app needs widens the attack surface, raises privacy concerns, and can lead to a store rejection or user distrust. The principle is to request the least access that lets the feature work.
How to review permissions
Read the Android manifest and the iOS entitlements and usage descriptions, and ask one question for each entry: does a real feature need this? Then check what the bundled SDKs do with the access, since a tracker can use a permission the app requested for another reason. Testing surfaces both the declared permissions and how they are used at runtime.
For the wider checklist, see a mobile app security checklist.
Common questions
What are dangerous permissions on Android?
Is asking for many permissions always bad?
How do I see what permissions an app requests?
See it on one of your own apps
Mobexa tests the exact Android or iOS build you ship and maps every finding to the OWASP Mobile Top 10 and MASVS.
Start Free Trial