In theory, should it be possible to root your device with an APK file? Or possibly create a potential harmful application?
I know that APKs can be used as apps you can install offline, but I'm assuming it could be used to be malicious. But what all could it do? How destructive could it be? And is there even a limit; a system to protect you from stuff like this?
Rooting a device with an APK file is definitely possible.
In reality it depends on two factors:
The device software age is important as usually you can say the older the device the more security vulnerabilities it has and therefore there is a higher chance to get a combination that allows you to root the device.
For example the very old devices can all be rooted using the TowelRoot app (which uses AFAIR an kernel exploit).
The price you are willing to pay for an exploit is important as you can buy exploits (even zero day exploits that are not known to Google or the device manufacturer).
Once a malicious APK has been installed it can use the incorporated exploits to attack your system. Once it managed to find a working exploit to get root it can do anything you could do with root permissions, too. This includes installing code persistently into your system, redirecting traffic, extract passwords and other secrets, ...
Q & A