  Android is the most widely deployed end-user focused operating system. With
its growing set of use cases encompassing communication, navigation, media
consumption, entertainment, finance, health, and access to sensors, actuators,
cameras, or microphones, its underlying security model needs to address a host
of practical threats in a wide variety of scenarios while being useful to
non-security experts. To support this flexibility, Android's security model
must strike a difficult balance between security, privacy, and usability for
end users; provide assurances for app developers; and maintain system
performance under tight hardware constraints. This paper aims to both document
the assumed threat model and discuss its implications, with a focus on the
ecosystem context in which Android exists. We analyze how different security
measures in past and current Android implementations work together to mitigate
these threats, and, where there are special cases in applying the security
model in practice; we discuss these deliberate deviations and examine their
impact.
