Read the exception message precisely
Use the crash guide to locate the failing API and preserve the redacted message. Messages often identify the required permission, UID or component.
Do not add every permission mentioned online. Some permissions are signature-level or otherwise unavailable to an ordinary third-party app.
Match the API's access model
| Access model | Required investigation |
|---|---|
| Normal permission | Correct manifest declaration |
| Dangerous permission | Declaration plus runtime grant where required |
| Special access | Dedicated user/settings flow and eligibility |
| URI access | Correct grant and lifetime |
| Signature/privileged API | Whether your app is allowed to use it at all |
The runtime permission guide and permission reference explain the distinction.
Test revocation and lifecycle changes
A permission granted yesterday may be revoked later. Check immediately before the protected operation where the API requires it and handle denial without crashing.
A cached boolean is not a durable guarantee of access. Similarly, a URI grant may not survive the way the app expects unless persistence is supported and correctly requested.
Check version-specific behavior
Record device API level and app target SDK. The same source code can encounter a stricter contract on newer Android versions or after a target SDK update.
Avoid catching the exception and continuing as though the protected operation succeeded. Return an explicit recoverable state.
Validate the narrow correction
APKLint's Manifest and Permissions checkers can help inspect declarations, but they cannot grant runtime access or prove the current caller's privileges. The fix needs a successful authorized operation and a safe denied/revoked path on the relevant platform versions.
Read the denied operation before requesting anything
A SecurityException while opening a previously selected document does not necessarily mean the app needs a storage permission. The URI's grant may have expired, been revoked or never been persisted through the supported provider contract. By contrast, a camera call can fail because a runtime permission is absent. Preserve the operation, device API level, target SDK and sanitized exception message before changing the manifest.
Classify the requirement: a normal manifest permission, a runtime permission, special access managed through settings, a URI grant, or a signature-level restriction. These mechanisms are not interchangeable. An ordinary third-party application cannot obtain a privileged platform capability simply by adding its permission name to the manifest or repeatedly displaying a runtime dialog.
Handle access that changes after the screen opens
Imagine a document editor that remembers a content URI across launches. On the next launch, attempt access through the intended provider and handle loss of the grant by asking the user to choose the document again. Preserve unsaved work separately where the product supports it. Do not silently create a new empty document at a different location and label the original file successfully opened.
For runtime permissions, Android's permission-request guidance requires a current permission check when the protected operation is performed. A boolean cached during the first launch can become wrong after a user changes settings. Explain why access is needed at the relevant action and support denial with a deliberate reduced-function state.
Exercise granted, denied and revoked states on the supported API range. For URI-based features, test both an immediately returned URI and a legitimately retained grant after process recreation. For interactions with another app, check the receiving component's exported and permission requirements rather than weakening your own application's entire component surface. Keep the catch narrowly around the recoverable access boundary, clear any stale success indicator and preserve a diagnostic category without recording private paths or tokens. A successful repair respects the platform's access decision while giving the user a practical recovery path; suppressing the exception and continuing as if a read or write succeeded is a data-integrity defect.
Sources and further reading
- Android Developers: Diagnose and fix crashes
- Android Developers: Request runtime permissions
- Android Developers: Manifest.permission reference
Reference review: 29 September 2026. Examples illustrate the workflow; check your installed versions, release artifact and account-specific Console requirements before applying them. This guide is not a claim that APKLint executed your project or verified your private account.
Android inspection tools and practical release guides. About APKLint · Report a correction
