Google has warned that any Android app holding a long-standing contacts permission can quietly alter the phone numbers stored in a user's address book, according to Dagens.no. The company outlined the risk in its developer blog and used the Android Dev Summit in late October to present a replacement permission system. The safeguards will not reach users until Android 18 arrives next year, but Dagens.no reports that the exposure already applies to Android handsets today.
Why it matters
The permission at the centre of the warning is WRITE_CONTACTS. Once an app is granted it, Google says the app can make sweeping changes to contacts across the whole device in the background while the user does nothing. Most apps have no real need for access that broad, yet a single approval during installation hands it over.
The practical danger is easy to picture. An app with contact-writing rights can replace the saved number for a contact — a bank, for instance — with a fraudster's line, and nothing appears on screen while it happens. When the bank later seems to call, the familiar name shows up on the display and the person answering is actually a criminal. Dagens.no notes that calls appearing to come from a bank are among the most common tactics in phone fraud, and Android Police has singled out this pattern as the clearest risk posed by the old permission.
Two paths replace one broad permission
Google's plan splits apps into two groups. Apps that only need to save or edit a single contact will no longer require WRITECONTACTS at all. Instead they will go through a standard contact editor using intents — ACTIONINSERT, ACTIONEDIT and ACTIONINSERTOREDIT — which shows the user a normal editing screen so that nothing happens silently in the background.
Google also said it has fixed several shortcomings in that route. Contact intents previously behaved differently from one device to another, and some editors dropped data the app supplied, such as a contact photo, according to the developer blog.
For dialer replacements, contact managers and sync apps that genuinely need wide access, Google is introducing a "special app access" permission called MANAGE_CONTACTS. It will not be granted through the usual pop-up prompt; users must switch it on manually under Settings and Special app access, according to the Android Developers' Blog. Developers will also have to declare the need for it in Google Play Console.
MANAGECONTACTS arrives with Android 17 QPR2 in the fourth quarter of 2026. The block on legacy WRITECONTACTS writes takes effect for apps targeting Android 18 in 2027.
What users can do in the meantime
Until Android 18 rolls out, Dagens.no reports there is no automatic protection. Every Android phone remains exposed regardless of version as long as WRITE_CONTACTS stays open.
The advice is to review which apps hold contact access and revoke it where it serves no purpose. Dagens.no suggests paying particular attention to apps installed outside Google Play, old games, tools no longer in use, and any app whose function has no reasonable link to the address book — a lamp-control app or a simple game has no grounds to write to contacts. Dialers, messaging apps and cloud sync services tied to Google, Microsoft or Samsung accounts are a different case, since contact access is often necessary for them, and they are the kind of service that will need MANAGE_CONTACTS going forward.
The next milestone to watch is the Android 17 QPR2 release in the fourth quarter of 2026, when the new permission becomes available, followed by enforcement against apps targeting Android 18 in 2027.
