Maybe there&#x27;s a private API on iOS that leaks the user&#x27;s email addresses without the proper permissions. Maybe there&#x27;s one on Android too. Neither OS has a runtime that will prevent malicious apps from exploiting such an API.<p>&gt; What I wrote was you are not going to be able to call an Android API via private invocation and succeed if the API requires a specific permission and your app hasn&#x27;t declared it<p>Just like on iOS, with the difference that it happens at call time and not installation time.<p>&gt; All of this only goes to prove that Apple&#x27;s security in iOS is not extraordinary as you claim<p>It shows the exact opposite! Notice how <i>ridiculously weak</i> these results are. On one of the most high-profile targets today, an app may (unconfirmed) be able to determine the user&#x27;s email address and send it to a server. On a trojan app that the user deliberately installed, and then deliberately granted access to Twitter, it can post a tweet without the user&#x27;s confirmation, if the user has not updated the OS. Fetch the smelling salts!<p>Meanwhile, millions of Android phones are part of botnets, like NotCompatible.C, at one point reaching 1.5% of mobile devices in the USA. A Chrome 0-day came out last week, allowing full control remotely of fully-patched Android phones. These aren&#x27;t research papers showing theoretical attacks, this is real life.<p>Yes, iOS has extraordinary security, and its competition only makes it look better.