GoKawiilGoogle plans finer-grained contacts permissions for Android apps
Google is updating Android's permission system so apps can request rights to edit a single contact rather than full WRITE_CONTACTS access to an entire address book. The change introduces standardized intents for individual insert or edit actions, building on contact-reading restrictions already introduced in Android 17. Initial pieces are expected to arrive with Android 17 QPR2 later this year, ahead of broader changes in Android 18.
GoKawiil's interpretation of the reporting above, not reported fact.
Limiting apps to narrower contact permissions could reduce the damage a malicious or compromised app can do, since broad WRITE_CONTACTS access currently lets any approved app overwrite all stored entries. Google engineer Mishaal Rahman suggests this could be exploited to insert fake contact details used in impersonation scams, so tightening the permission model may close off a real attack vector. The phased rollout suggests Google is treating this as a multi-release effort rather than a single quick fix.
- Android apps currently get all-or-nothing access to a user's full contact list via WRITE_CONTACTS.
- Google is introducing standardized intents allowing single-contact insert or edit requests instead.
- Initial changes are expected with Android 17 QPR2, with further rollout planned for Android 18.
Source: androidauthority.com, 2026-10-27
Published there as: “Android is locking down permissions to keep apps from messing with your contacts”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.