Android includes a permission system used to restrict apps to certain actions, but reading from the file system isn’t one of them. Only writing to the SD card requires a permission check.

All it takes to trigger the bug is for attackers to send a crafted, malicious Portable Network Graphic (.PNG) file to a victim's device. Should the user open the file, the exploit is triggered.

Open the app on the Play Store on your phone or tablet.; Scroll down to Data safety and tap the arrow next to it.; Scroll down to Data collected.This lists the personal data that the app collects ...