Specifically, Paul Brodeur of Leviathan created a test app that requested no permissions and installed it on some Android devices.

CNN: 'No permission' Android apps can see and share your data