Why does my app has the READ_PHONE_STATE permission although it's not declared in manifest?

I was able to resolve the problem. It's similar to the solution of reneph.

I found that one library had no minSDK specified neither in the build.gradle nor in the manifest file. After adding

defaultConfig {
    minSdkVersion 14
    targetSdkVersion 21
}

the permission was gone. I don't know why it worked without the permission on my previous build (also no minSDK specified). Must have been either the Android Studio 1.0 or the Android SDK update.

---

Android developer documentation for READ_PHONE_STATE permission:

Note: If both your minSdkVersion and targetSdkVersion values are set to 3 or lower, the system implicitly grants your app this permission. If you don't need this permission, be sure your targetSdkVersion is 4 or higher.