# How READ\_PHONE\_STATE Can Sneak Into an Android App

DevFeed: [How READ\_PHONE\_STATE Can Sneak Into an Android App](<https://devfeed.tech/articles/how-dangerous-permissions-sneak-into-apps-28669.md>)

Original publisher: [Read original article](<https://jeroenmols.com/blog/2018/08/02/phonestatepermission/>)

Author: info@jeroenmols.com (Jeroen Mols)

Published: 2018-08-02T00:00:00Z

Content type: article

Language: en

Sources: [Jeroen Mols](<https://devfeed.tech/sources/jeroen-mols.md>)

Topics: [Post Mortem](<https://devfeed.tech/topics/post-mortem.md>), [Android](<https://devfeed.tech/topics/android.md>), [Android Studio](<https://devfeed.tech/topics/android-studio.md>), [modules](<https://devfeed.tech/topics/modules.md>), [Firebase](<https://devfeed.tech/topics/firebase.md>)

Tags: [android](<https://devfeed.tech/tags/android.md>), [android-studio](<https://devfeed.tech/tags/android-studio.md>), [blogs](<https://devfeed.tech/tags/blogs.md>), [firebase](<https://devfeed.tech/tags/firebase.md>), [google-play](<https://devfeed.tech/tags/google-play.md>), [manifest](<https://devfeed.tech/tags/manifest.md>), [modules](<https://devfeed.tech/tags/modules.md>), [permission](<https://devfeed.tech/tags/permission.md>), [permissions](<https://devfeed.tech/tags/permissions.md>), [post-mortem](<https://devfeed.tech/tags/post-mortem.md>)

## AI overview

This post-mortem explains how READ_PHONE_STATE unintentionally entered an Android app through manifest merging. It traces the issue to a translations module without an explicitly set targetSdk and describes setting targetSdk values across modules and removing the permission during merging.

## Source excerpt

This is a post-mortem where the very dangerous permission, READ_PHONE_STATE, unintentionally sneaked into our app. Here's how this could happen, how we debugged and finally how we solved it.