The researcher goes on to note that even without an Internet permission, he was able to use something called the URI ACTION_VIEW Intent to open a browser and export any collected data.

In essence, Android's approach to notifications is that it's better to ask forgiveness than permission. And Android users have lived like that since its inception.

A zero-permission app designed and tested by Paul Brodeur revealed major Android security vulnerabilities both in 2.3 and 4.0 versions.

If you've got Android, you know it shows you a list of permissions an app wants you to accept during installation -- and often, it seems like the app wants permission to do an awful lot of things.