Let's take Stagefright for example, the media library written in C++
How overflows bypass assigned privileges is simple; C code can directly write to memory. It's your job as developer to make sure what you put in fits, otherwise it will happily write over other instructions of the same privilege. Stagefright has a lot of privileges. And the information that flows out of the buffer could be a random cat video from the internet(which then -gains- the privileges of the media library)
So it would be naive to assume overflows are not harmful. Stagefright contained buffer overflows and this is extremely dangerous.
Android developers have made exploitation harder by implementing (among other measures) address space layout randomization (ASLR), this makes the offsets to use unpredictable, causing a fault rather than code execution. But by combining this with browser vulnerabilities, information can be leaked about the current location of the memory pages so code execution is still possible.
I would recommend reading up on Metaphor, a Stagefright implementation including ASLR bypass, the paper and PoC code are available online