Why does my app has the READ_PHONE_STATE permission although it's not declared in manifest?

Question

I noticed the READ_PHONE_STATE permission when I uploaded the apk to google play. I have not added it and it is not written anywhere in my manifest or any other file of my p

Answer 1

One cause could be a (transitive) dependency, i.e. a library, that declares a minimum required Android SDK level below 4. In this case the "manifest merger tool" will add those permissions implicitly.

Lower-priority manifest declares                   Permissions added to the merged manifest

targetSdkVersion <= 3                              WRITE_EXTERNAL_STORAGE, READ_PHONE_STATE 
targetSdkVersion <= 15 and using READ_CONTACTS     READ_CALL_LOG 
targetSdkVersion <= 15 and using WRITE_CONTACTS    WRITE_CALL_LOG

Source: https://developer.android.com/studio/build/manifest-merge#implicit_system_permissions

Look into the manifest-merger-*-report.txt log, found in build/outputs/logs if this was case.