In the permission-based security model (used e.g. in An-droid and Blackberry), applications can be granted more permissions than they actually need, what we call a "per-mission gap". Malware can leverage the unused permissions for achieving their malicious goals, for instance using code injection. In this paper, we present an approach to detecting permission gaps using static analysis. Using our tool on a dataset of Android applications, we found out that a non negligible part of applications suffers from permission gaps, i.e. does not use all the permissions they declare.