“The alarming truth,” warned the researcher, “is that the average number of permissions requested by a flashlight app is 25.”

“Asking for too many permissions is dangerous,” ESET malware researcher Lukas Stefanko explains. “These permissions can be misused as an exploit to access more device components, such as call logs, phone numbers, and browsing history.”

At the heart of Google’s challenge has been so-called permission abuse—millions of apps requesting the rights to access device data and functions beyond those needed to deliver their own functionality.

The security feature in Android 11 is a long overdue crackdown on this permission abuse.

Google’s novel response has been to compare each app to its peers, identifying those that seem to be asking for more than they should, and alerting developers when that’s the case. In its update today, Google says “we aim to help developers boost the trust of their users—we surface a message to developers when we think their app is asking for a permission that is likely unnecessary.”