> Applications within a sandbox only has visibility into the resources I define Isn't that more than a typical sandbox what you're asking for? The GrapheneOS

> Applications within a sandbox only has visibility into the resources I define Isn't that more than a typical sandbox what you're asking for? The GrapheneOS developers said they're working on a feature where every app could be run in its own VM, like on ChromeOS: https://discuss.grapheneos.org/d/20647 https://discuss.grapheneos.org/d/20647 > some folders, no camera or mic etc. I understand that app permissions do the same The "some folders" part is already true for Android. Apps can't blanket access files/folders of other apps (save for ones stored in "external storage", which has also been scoped down in the recent releases: https://source.android.com/docs/core/storage/scoped https://source.android.com/docs/core/storage/scoped). > more convenient than having to define granular permissions each time you install an app It isn't Android that makes this inconvenient. It is the app developers that cause "prompt fatigue" (by showing permission requests repeatedly) or "blackmail" by refusing to work until permissions are granted. A new sandbox mechanism is unlikely to change much.