[conite]

Actually that scenario (exploit user data or permission without knowing) happened recently. It's called joker virus. The virus simply could bypass user's agreement part and use that benefit to gather user's privat data or even sign them into paid scam subscription. Google has removed 24 apps infected by this malware and now working to update the patch.

What I've never seen is exploits that can ruin my /system directory and tamper my OS in direct remote. Never happen even in my old xperia and note 4 (running unofficial android ROM).

Joker has to be removed from the apps. It's not a security patch issue.

[chain13]

Joker has to be removed from the apps. It's not a security patch issue.

For now it has to.
Next patch will close this "user bypassing" scenario in variety of cases including elevating permission.

[Tsepz_GP]

I did well?

If that’s what works for you Mate.

Loving my XS Max it’s a beast, but not for wveryb