Security implications of remote (Meterpreter) shell to device An attacker who uses an exploit for e.g. CVE 2012-6636 can use a Metasploit exploit to open a Meterpreter shell in the context of the stock Android browser.

But what are the implications of such an attack?

As far as I understand the sandbox prevents the attack from accessing contacts, the microphone, the camera or other apps. He is limited to the data of the browser and the SD card. 

Even if a device is rooted, there is no way to gain root privileges from within such a shell, or is there? 

So the only way to escape from the sandbox would be to tamper the app's memory and make use of another exploit, that leads to privilege escalation, right? Therefore the impact of such an attack would be very limited.
That's right. An attacker can only create a shell with this tools/exploits. But if kernel has a vulnerability like privileges escalation, he (attacker) can gain root access then. (This  only exists when kernel has a vulnerability. This is so important.)

But  maybe attacker can execute malicious code with shell/interpreter then gain root access. Something like localroot.  Exactly what you said :


  So the only way to escape from the sandbox would be to tamper the
  app's memory and make use of another exploit, that leads to privilege
  escalation, right? Therefore the impact of such an attack would be
  very limited.


your question = your anwser