Android’s kernel-level app sandbox provides security by:

A.
assigning a unique user ID (UID) to each app and running in a separate process.

B.
running all apps under an unprivileged group ID (GID).

C.
restricting read access to an app’s package to the kernel process.