Android Permissions and Malware Can an Android Malware App "hide" certain important permissions thereby fooling the user to be "good" (or intended to do only what its posed purpose is). Thus can the user "believe" the App to be genuine and install it?
In short is there anyway an App can fake its permissions? I know that there is an AndroidManifest.xml which every developer of App must customize in order to get the necessary permission. And most certainly this is what gets displayed to the user so that he/she can acknowledge before he/she installs the App.
Now my question is, is there a way the user is not "shown" any of the permissions??
No. At least not without bugusing. All permissions not written into the manifest, will not be granted to the app by android. Since Android 6 an app can also request permissions at runtime. Then they are not in the manifest and the user does not grant them when installing but as soon as the app requests those permission, the user will have to grant them.

In short: you have control over the permissions and there is no easy way to bypass this system.

There is however the possibility to use other apps to bypass the permission handling. E.g. if your app does include a chrome browser window, it's not necessary for your app to have the internet access permission since chrome already has that permission.