They don't have filesystem access, see the permissions overview in the OS settings for the app But also how would the client be vulnerable in a way that leads

They don't have filesystem access, see the permissions overview in the OS settings for the app But also how would the client be vulnerable in a way that leads to a compromise? Connecting to a domain that doesn't exist anymore? Even then it would need to download executable code, or exploit a bug that leads to it reading and uploading arbitrary files—if it had filesystem access in the first place. Working in the security industry, I never hear of people needing to update mobile apps for such a bug, it seems to be exceptionally rare. Most issues are server problems, direct object access (missing permission checks on invoice pdf downloads or so) or such I do update things like SSH (yes, on my phone) because that actually exposes a port on the network, or email/messaging clients where anyone can send arbitrary content (how many times have we heard of image parsing bugs being exploited through a messaging system like SMS or WhatsApp?); that's not really the case for Spotify. There's attack vectors like the URIs that the app can handle, but it's not wormable in the same way because it requires user interaction and so won't go viral. It would be a specific attack and there's easier ways to target me > (or are all android apps really sandboxed nowdays? I doubt it) You might want to read up on this. They've always been isolated.