Does there exist some standard API that allow an Android malware to download and install a SSL/TLS certificate as RCA, in the default keystore, in non-root devices?
I think that this is a very underestimated problem.
Any app can create a new
KeyStore and do arbitrary things with it. So it is possible for a malware to import a downloaded root CA and use it for TLS connections originating from the malware itself.
This does, however, not impact any other app, as global
KeyStores are not affected. To change it using official APIs, one needs to create an install intent via
createInstallIntent, which can then be used to bring the certificate installation dialog up. Unless the user confirms the dialog, the certificate will not be installed.
Note that this answer does not consider exploits or other means outside of regular APIs to gain write access to global
KeyStores, as your question explicitly asks for standard API only. An app with root access can of course use other means to change the list of root CAs.