Can an android app steal a stored password from any other app I have installed?
Say I have snapchat and I only log in once and stay logged in, if I later delete the cache from that app it will log me out.
Are the stored passwords vulnerable?
Welcome Alfredo :)
No. Android apps are "sand-boxed" inside their own user in the operation system. So unless Snapchat/you Android version have a specific vulnerability (and if you update your phone this shouldn't happen), other apps are not able to get stored passwords.
Android is based on the Linux operation system. Thus, it isolates apps from each other and protects apps and the system from malicious apps. To do this, Android assigns a unique user ID to each Android application, which means all the application files, unless defined otherwise, are protected and accessible only to this specific application (user id).
Android also implemented an account manager, in order for apps to save tokens and passwords securely. In short - that's an encrypted DB that is managed by the operation system itself, and every app could save tokens/passwords using it, in a secure manner.
It depends on what you mean by storing the password. It may be done by each app persisting the data in SharedPreferences, or in something like a sqlite database, or file-based storage. Or, perhaps you're referring to the the android keystore provided by the system.
In the first case (SharedPreferences, sqlite, etc.): By design, each app is supposed to be in its own sandbox. Other apps should not have access to their data. The protection is based on linux permissions. However, there are vulnerabilities, so SELinux has been used in recent years, and the permissions are getting stricter and stricter with each version of android, e.g., what system data that ordinary apps can access is more and more restricted.
In the second case, it could be considered more secure, managed by the android system.
However, it is very common to find android devices that are rooted. The process of rooting removes many of the protections, so android keystore and other app data should all not be considered as safely stored. Some apps like bank apps, or games like Pokemon Go, implement root detection features to prevent the app from running on rooted devices.