That's what PowerBoxes are designed to do in the capability-based, security mode...

		nickpsecurity on March 25, 2018 \| parent \| context \| favorite \| on: Facebook scraped call, text message data for years... That's what PowerBoxes are designed to do in the capability-based, security model. In theory, it can happen if Android had different model. http://www.plash.beasts.org/powerbox.html Note: I'm using this link just to explain the concept rather than endorse anything on the site. It was top of Google results.

For what it's worth, Fuchsia, the new OS Google is working on, is capability-based.