jolly2765 have you noticed that the photo was not actually taken by the said app? It sends intent to the camera app which takes the photo and app then reads the photo from shared storage. It does not need camera permission and no bypasses are taking place here.