Android Permissions and Malware
No. At least not without bugusing. All permissions not written into the manifest, will not be granted to the app by android. Since Android 6 an app can also request permissions at runtime. Then they are not in the manifest and the user does not grant them when installing but as soon as the app requests those permission, the user will have to grant them.

In short: you have control over the permissions and there is no easy way to bypass this system.

There is however the possibility to use other apps to bypass the permission handling. E.g. if your app does include a chrome browser window, it's not necessary for your app to have the internet access permission since chrome already has that permission.