> Google has added pop-up permissions for particularly sensitive information, but this feature allows a malicious developer to run arbitrary app code on a devic

> Google has added pop-up permissions for particularly sensitive information, but this feature allows a malicious developer to run arbitrary app code on a device without prior user consent so we have to think about security differently. While true in general for Android apps - Android apps can get i.e. a low privileged Linux shell and general internet access without explicit permissions - Google would be quite stupid indeed to allow this for instant apps as well. It would be too obvious a security hole. It's also surprising to me that this hasn't been discussed at greater length, but I really don't expect instant apps to have the same freedoms regular apps have.