Files app could install apk without permissions

demihalf

Good morning,

I am sorry if I misused the tags, I selected what I thought it was best.

I think I found an unwanted behaviour regarding Install unknown apps permission on com.android.documentsui (Files) app.

Step to reproduce:

Download an .apk file (eg mullvad )
Open Files app through the launcher (I am using the official GrapheneOS launcher)
Tap on .apk file
Install/update the app

Expected behaviour:
I should receive an error message asking me to add the permission to install unknown apps before proceding (like it happens if I try to open the .apk file from Vanadium's Download page: screenshot)

Actual behaviour:
I could update mullvad: screenshot1 and screenshot2

Additional Notes:
I double checked that the permission was off.
I also tried to activate it, same behaviour.
Disabling it again, same behaviour.
This behaviour is present also for new apps: screenshot.
I have the same behaviour if I try to install/update an app using Files also in the private space.
I currently am using the latest stable version of GrapheneOS available to me: 2026021201(still didn't received march)
I currently am using the following Files installation:

Version 16

com.android.documentsui
versionCode 36

targetSdk 36
minSdk 31

Installed: 14 Feb 2025; 19:08

I do not remember the first time I noticed this behaviour, but it is at least 2 months.

I understand screenshots might not be a full proof like a video, but I would like to avoid this kind of exposure on the internet, if really needed I can record it and "pm" the video.

Thank you for your attention.

Novalissoide

demihalf This is a known quirkiness of the stock Files app.
https://discuss.grapheneos.org/d/5587-installed-apk-despite-no-permission-granted

koocmit

demihalf I can confirm this happens. Replication steps:

Check that both the browser used to download the file and the default files app do not have install from unknown apps permission.
Download an apk not previously installed on the phone. (I chose florisboard, the version just before the latest version).
Navigate to the files app, do not install from the download notification or download menu on browser.
Click on the apk, it will give the option to install. On clicking "install" it will install the app without asking to provide the permission.
You can repeat the same flow for updating the app.

@demihalf I would recommend you open an issue on https://github.com/GrapheneOS/os-issue-tracker/issues

Novalissoide known quirkiness

If you open the app info page, it does display an "install from unknown sources" permission area, which is disabled for the default files app. This can be misleading to the user.

demihalf

Novalissoide
Thank you for pointing this, but I am somewhat sure that in a certain point of time (last year, I think) I needed to explicitly give the stock Files the permission to install an app, or I am misremembering?

Also, is there a reason why Files shouldn't obey to the OS permissions?

nandohyphen1

demihalf I am somewhat sure that in a certain point of time (last year, I think) I needed to explicitly give the stock Files the permission to install an app

Yes you did. This new behaviour of installing unknown apps started in Android 16. I am also concerned about this. I opened an issue on GitHub, and Daniel Micay (founder of GrapheneOS) replied and said this is normal Android 16 behaviour. I still don't like it though

Novalissoide

koocmit yes, but this is likely an upstream AOSP-bug, since the Files app is one of the old apps from that project. By the way, I'm just another user.😉

littlerack

Novalissoide upstream AOSP-bug

Read comments fromdevs on the relevant issue. They doubt this can be called bug, just an aspect of stock. One still can't call it a privileged app.

Novalissoide

littlerack doubt this can be called bug

That's why my first notion of 'a querkiness' rather than a bug. But any phenomena going against the expressed in-UI description is if not a bug, say, unwanted?

demihalf

littlerack One still can't call it a privileged app.

Why not?
How would you call an application that can ignore a set permission?

horde On Samsung, apks in Files require permission to be installed.

Can you please check the app "name"?
The equivalent of com.android.documentsui, I mean.

Novalissoide But any phenomena going against the expressed in-UI description is if not a bug, say, unwanted?

I would say unwanted behaviour, at the very least.
For other application we have something like: "You cannot set this permission to this app" or "This app is known to need this permission to work properly", stuff like this.
In this case I have a working UI to set a permission that doesn't change anything.

littlerack Read comments fromdevs on the relevant issue.

Can we have a link to the issue, please?

Anyway, there probably is a rational explanation behind it, I guess, I just fail to understand why.

horde

On Samsung, apks in Files require permission to be installed.

kaisernatron

nandohyphen1 That behaviour does sound concerning, also Daniel's back?

nandohyphen1

kaisernatron also Daniel's back?

He's been around on GitHub for a while, I think. @thestinger. Who knows. Its possible @GrapheneOS here on the forum is Daniel. I'd think it is, but it could also be an account that the entire development team uses. Who knows. 🤷🏻‍♂️

userofgos

kaisernatron He never left, he only stepped down as lead developer but is still deeply involved in the inner workings of the GrapheneOS project.