Is it possible for an app to gain permissions that aren't disclosed to the OS?
I recall reading about the Facebook/Meta app a few months ago where the app was able to gain access it shouldn't have had by leveraging a connection to localhost as i recall. I don't recall the details, but it seemed like a novel way of breaching its boundary.