Subway Surfers Mod APK Permissions — Full List Explained (2026)
This version declares 18 permissions in its AndroidManifest.xml. None of them touch contacts, camera, microphone, precise location, SMS, or accessibility services — the categories that would actually be a red flag on an endless-runner game.
Android separates what a manifest declares from what the system actually grants at runtime — a dangerous-category permission listed in the package doesn’t mean Android handed it over without a prompt, and a connectivity permission like INTERNET is granted automatically with no prompt at all. The 18 below are what this version asks for; what matters for a safety read is which category each one falls into, not the raw count.
QUICK FACTS
TOTAL DECLARED
18 (4 Core Runtime)
NEVER SHOULD REQUEST
Camera, Contacts, Location, SMS
ANDROID 13+ SETTING
Restricted Settings Barrier
STORAGE ACCESS NEEDED
None Declared
VERIFICATION METHOD
SHA-256 Hash + VirusTotal
The Full Permission List (18 Declared)
Four permissions run the game itself; the other 14 exist for notifications, Play Store billing, and advertising — not for anything the gameplay needs.
Core runtime (4): INTERNET, ACCESS_NETWORK_STATE, WAKE_LOCK, VIBRATE — World Tour updates and leaderboard sync, checking for a connection before trying, keeping the screen awake mid-run, haptic feedback on collisions.
Push messaging (4): POST_NOTIFICATIONS, com.google.android.c2dm.permission.RECEIVE, DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION, C2D_MESSAGE — sending and receiving push notifications through Google’s Cloud Messaging.
Billing and licensing (4): com.android.vending.BILLING, com.android.vending.CHECK_LICENSE, and two separate BIND_GET_INSTALL_REFERRER_SERVICE permissions (Android’s and the Play Store’s own) — in-app purchase processing and Play Store license checks, present even though this version’s balances come from the file itself, not a purchase.
Advertising (5): com.google.android.gms.permission.AD_ID plus the four ACCESS_ADSERVICES permissions (Topics, Attribution, Ad ID, Custom Audience) — reading the device’s advertising ID and participating in Google’s Privacy Sandbox ad APIs, declared because 10 separate ad-network libraries are packaged inside this version (AppLovin, Google AdMob, Meta Audience Network, Unity Ads, ironSource, Vungle, InMobi, Mintegral, Pangle, and Moloco), each one a potential consumer of these permissions.
Platform attestation (1): com.amazon.privacypass.ATTEST — a device-attestation check one of the bundled ad or billing libraries uses.
A reset advertising ID applies across all 10 networks at once rather than needing a per-network opt-out — Android 12+ handles that reset from one control, under Privacy → Ads in device settings, independent of anything in the game itself.
The billing permission is worth a specific note: the balances on this version are already unlocked in the file itself rather than sold through a checkout flow, so com.android.vending.BILLING isn’t there to process anything here — it’s declared because Google Play’s billing library ships inside the underlying game code on every version, used or not.
Permissions That Should Never Appear
An endless-runner game has no functional reason to ask for your contacts, camera, microphone, SMS, or precise location. If an install prompt or a later update requests any of these, cancel it:
Personal Data Access
READ_CONTACTS or READ_CALL_LOG — no legitimate version reads your address book.
READ_SMS or RECEIVE_SMS — a request here is a premium-SMS fraud pattern, not a game feature.
CAMERA or RECORD_AUDIO — the game has no camera or voice-chat feature to justify either.
Location and Device Access
ACCESS_FINE_LOCATION or ACCESS_COARSE_LOCATION — running on subway tracks needs no GPS coordinate.
READ_PHONE_STATE — older builds used this to read a device’s IMEI; current Android versions restrict IMEI access regardless, and this build identifies devices through the advertising ID above instead.
REQUEST_INSTALL_PACKAGES — a request to install further packages from inside the app itself has no reason to exist in a single standalone game.
Background Execution and Battery Permissions
This version declares neither RECEIVE_BOOT_COMPLETED nor REQUEST_IGNORE_BATTERY_OPTIMIZATIONS — confirmed in the same manifest parse as the permission list above. The game doesn’t start itself when the phone boots, and it doesn’t prompt for a permanent battery-optimization exemption, the pattern malware uses to stay running in memory after you close it. Manually setting the app’s own battery mode to Unrestricted in Android Settings for smoother gameplay is a different, user-initiated choice — install-guide links to the performance-tuning guide that covers it, since it isn’t a permission the app itself requests. Without that permission, standard Android Doze mode applies the same way it would to any other foreground game: the app suspends network and background activity once it’s minimized, rather than running on indefinitely in memory.
The “Restricted Settings” Message — Does It Apply Here?
No. Restricted Settings only blocks a sideloaded app from getting Accessibility or Notification-listener access — a different permission from POST_NOTIFICATIONS above, which only lets the app send a notification, not read other apps’ notifications. Install-guide covers the full Restricted Settings scope and unlock steps for the cases where it does apply.
Managing Permissions by Phone Brand
Checking or changing what’s already granted uses a different menu than the one that grants the install-source permission before installing:
Samsung (One UI)
Settings → Apps → Subway Surfers → Permissions, then toggle any category to Don’t Allow.
Xiaomi (MIUI/HyperOS)
Settings → Apps → Permissions → Autostart (confirm it’s off), and Security app → Permissions for everything else.
Pixel and OnePlus
Settings → Privacy → Permission Manager for a single dashboard across every installed app.
Checking this periodically catches the one scenario worth watching for: a permission toggled on that isn’t among the 18 listed above, which would point to a different file than the one listed on Subway Surfers Mod APK.
Is This Permission List Actually Safe?
The list is consistent with what the game and its bundled ad SDKs actually do — nothing requested here needs personal data the game has no use for. That’s not the same as a complete safety verdict: a permission list describes what the app is allowed to access, not what its code actually does with a network connection once it’s running. A harmless-looking permission can still be misused by code that has it, and the manifest has no way to show that difference — it’s a map of what’s possible, not a transcript of what happens. The Subway Surfers Mod APK page covers the file-identity half of that question; the permission list above covers the other half.