Security model when asking access to photo, media and files When an app asks for permission to access photo, media an files, does the andriod security model sandbox the access to only files for that particular app?

Or can the app then access files created by other apps?

So many apps ask for permission to the file system, does that mean e.g. App#1 can grab files created by App#2?

I want to install WeChat but want to understand what security risk is involved potentially.
Preface

Given that you mention the appearance of a popup asking for the permission to access the Storage, I feel safe to assume that your Android version be 6.0 or greater.



The Storage permission

The Storage permission gives an app access to the contents of the /storage/emulated/0 path. This means that an app would then be able to read and write any file under said location, be it created by you or any other app. It is worth mentioning that this permission does not allow for manipulating an external SD card.

In plain English, /sdcard tends to contain any file you download, any photo you shot, any music you listen to, and so on.



The internal data

Any installed app has a private directory containing its data. These directories are located at /data/data/, and are named after the package name of each app. Since any app is sandboxed by means of an user id and a group id, any app can only access the data it owns, and the previously discussed Storage permission has no effect whatsoever. These directories should concern no one but expert users, as they're vital for apps to work.

There is, of course, an exception. If your phone is rooted, any app requiring root privileges will potentially be able to read and write from and to any location in your device. This means that, if rooted, you should always have a filter such as Chainfire's SuperSU or Phh's Superuser to be notified when an app requests such privilege, in order to be able to deny it.