Why does my app has the READ_PHONE_STATE permission although it's not declared in manifest?

Question

I noticed the READ_PHONE_STATE permission when I uploaded the apk to google play. I have not added it and it is not written anywhere in my manifest or any other file of my project. (I looked through all libraries for this permission)

My app did not have this permission in my previous build with same libraries. Since last build I updated android studio to version 1, updated my android sdk and made a few changes (in code) to my app. I don't request the device ID in my app.

My app has minSDK 14 and no ads. Here are my manifest permissions:

<uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" />
<uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />
<uses-permission android:name="android.permission.INTERNET" />
<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
<uses-permission android:name="android.permission.VIBRATE" />
<uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />

Here's the apk file

Answer 1

I was able to resolve the problem. It's similar to the solution of reneph.

I found that one library had no minSDK specified neither in the build.gradle nor in the manifest file. After adding

defaultConfig {
    minSdkVersion 14
    targetSdkVersion 21
}

the permission was gone. I don't know why it worked without the permission on my previous build (also no minSDK specified). Must have been either the Android Studio 1.0 or the Android SDK update.

---

Android developer documentation for READ_PHONE_STATE permission:

Note: If both your minSdkVersion and targetSdkVersion values are set to 3 or lower, the system implicitly grants your app this permission. If you don't need this permission, be sure your targetSdkVersion is 4 or higher.