To demonstrate this we’ve built an app which requires no permissions and yet is able to give an attacker a remote shell and allow them to execute commands on the device remotely from anywhere in the world.

via No-permission Android App Gives Remote Shell – viaForensics « viaForensics.

Here is a paper.