This is not so much a technical answer to your question, but a generalization. If you can determine what specifically an application must be able to do to func

This is not so much a technical answer to your question, but a generalization. If you can determine what specifically an application must be able to do to function properly, then you can write rules and implement them in Linux Security Modules (SELinux, AppArmor, Tomoyo) [1] that enforce mandatory access controls describing what the applications are permitted to do, then it becomes a bit harder to bend an application to do your bidding through code bugs and deficiencies. Android has SELinux, so this could be done on some cell phones. It would be up to cell phone vendors and app developers to work together to implement this properly. I am betting they won't actually do this, but some of the open source phones like PinePhone [2] might be open to it. You can also containerize applications and set/unset "capabilities" [3] for the container to the bare minimum required for the application. MAC + Capabilities implemented properly can make exploiting zero days significantly harder. It can also make spotting and logging exploit attempts easier. This raises the risk for people holding zero days to utilize and burn them. [1] - https://en.wikipedia.org/wiki/Linux_Security_Modules https://en.wikipedia.org/wiki/Linux_Security_Modules [2] - https://www.pine64.org/pinephone/ https://www.pine64.org/pinephone/ [3] - https://man7.org/linux/man-pages/man7/capabilities.7.html https://man7.org/linux/man-pages/man7/capabilities.7.html