Cordova adds unwanted permission to AndroidManifest.xml when building from CLI

In your project, edit the file plugins/org.apache.cordova.media/plugin.xml You'll see the android specific configuration

   <platform name="android">
        <config-file target="res/xml/config.xml" parent="/*">
            <feature name="Media" >
                <param name="android-package" value="org.apache.cordova.media.AudioHandler"/>
            </feature>
        </config-file>

        <config-file target="AndroidManifest.xml" parent="/*">
            <uses-permission android:name="android.permission.RECORD_AUDIO" />
            <uses-permission android:name="android.permission.MODIFY_AUDIO_SETTINGS" />
            <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />
            <uses-permission android:name="android.permission.READ_PHONE_STATE" />
        </config-file>
...

remove the line <uses-permission android:name="android.permission.RECORD_AUDIO" />like this the permission will not be added each time you build.

As the permission has already been added to AndroidManifest.xml, you'll have to remove it manually and then it should not come back next time you build.

To keep plugins from re-adding unnecessary permissions edit platforms/android/android.json.

Locate these lines and remove them:

{
    "xml": "<uses-permission android:name=\"android.permission.RECORD_AUDIO\" />",
    "count": 1
}

Please note that this is a "dirty" solution. After adding/updating plugins, you'll probably have to repeat this.

I have tried the suggestions above (from QuickFix and leuk98743) but the manifest file kept getting re-generated. So I created a hook to modify the manifest file during the build.

1. Add the content below into a file in your project: hooks/after_prepare/030_remove_permissions.js
2. If you're on Linux, make that file executable.
3. Modify the file to set the permissions you want to remove. There are 3 listed in my example but you should add/remove as appropriate.

#!/usr/bin/env node
//
// This hook removes specific permissions from the AndroidManifest.xml
// The AndroidManifest is re-generated during the prepare stage,
// so this must be run on the "after_prepare" hook.
//


// Configure the permissions to be forcefully removed.
// NOTE: These permissions will be removed regardless of how many plugins
//       require the permission. You can check the permission is only required
//       by the plugin you *think* needs it, by looking at the "count" shown in
//       your /plugins/android.json file.
//       If the count is more than 1, you should search through
//       the /plugins/<plugin-name>/plugin.xml files for <uses-permission> tags.

var permissionsToRemove = [ "RECORD_AUDIO", "MODIFY_AUDIO_SETTINGS", "READ_PHONE_STATE" ];


var fs = require('fs');
var path = require('path');
var rootdir = process.argv[2];
var manifestFile = path.join(rootdir, "platforms/android/AndroidManifest.xml");

fs.readFile( manifestFile, "utf8", function( err, data )
{
    if (err)
        return console.log( err );

    var result = data;
    for (var i=0; i<permissionsToRemove.length; i++)
        result = result.replace( "&lt;uses-permission android:name=\"android.permission." + permissionsToRemove[i] + "\" /&gt;", "" );

    fs.writeFile( manifestFile, result, "utf8", function( err )
    {
        if (err)
            return console.log( err );
    } );
} );