Can an Android app circumvent its stated permissions? I downloaded an APK from a 3rd party source (not Google Play). My question is that can this android app, although stated that it can only access my USB storage, could it also do other things (such as read IMEI) without stating it explicitly? In essence what I am wondering is that does the Android System actually prevent it or is it just something the developer states in their manifest?
As Meer Borg correctly states in his answer: when an app is installed, the package manager reads its Manifest, and notes the permissions requested into files the Android system controls (/data/system/packages.xml, /system/etc/permissions/*.xml (one file per app)). Additionally, for each permission there is a specific user group, which will be assigned to the app1. So each time the app tries to access a feature requiring a permission, this is checked against: if the permission was declared in the Manifest, access is granted – otherwise it's refused. note that this is a simplified description, though
While this is the general rule, for some things there are possibilities to work-around the permissions. If an app e.g. wants to send something to the internet, it could also do so calling an &quot;intent&quot;, asking the browser to open a certain page (like e.g. http://bad.server/collector.php?info1=some_info&amp;info2=more_info). However, this would not go un-noticed by the user, as the browser would open in foreground and show this action. So if an app would make use of this feature, the outcry would be heard (usually).
If a dev really wants to do &quot;bad things&quot;, he could also use another way: have one app with all the required permissions, and a second with almost none. If the user has both apps installed, the second one could call the first (big-permission) app to process &quot;things&quot; it cannot do itself (due to lacking permissions) – in the same manner as described above for accessing the internet. note that this priciple is used e.g. for addons, and &quot;inter-app-communication&quot; in a positive sense, too
TL;DR:
An app is restricted to the permissions it requests, and cannot directly access other &quot;things&quot;. &quot;Indirect&quot; access would not go unnoticed.
P.S.:
This is just an abstract, and simplified presentation. I'm not in Android development, so some dev might have better understanding and correct me, or add to the above.

1 Example (note the &quot;groups&quot; list):
shell@android:/ $ id
uid=2000(shell) gid=2000(shell) groups=1003(graphics),1004(input),1007(log),1009(mount),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats)

The id command (without parameters) shows information about the &quot;current user&quot;. In this case, I was using adb shell, so the user is the &quot;shell app&quot; (rather the integrated Unix shell). The list of groups shows which permissions are granted to the shell, So it can e.g. read and write the SDCard, access Bluetooth, and the Internet (plus some more things).