Is there security in Android?

Question

Android

Good afternoon.
Surfing the other day on Google for ancient myths. I open several sites from search results, then I read one page after another. At some point in time, I noticed that the android shows that the "update.pak" file is downloading. Please note that I am not a blonde who clicks on all the clickers in a row. Moreover, there were no clickanders / popunders / anything imposing - ordinary sdl, with useful material.
The stock firmware of the Sony Xperia Z1 with updated android (5.1.1) has the "install from unsafe sources" option turned off, so I decided to continue surfing and deal with the file (and from which site it came from) after. However, a day later, when the time turned up, I did not find the file. Maybe it's not in the Downloads folder? I also looked at the flash drive. And according to the history of sites, you can’t even really say where it could have come from.
So. It is embarrassing that something has been downloaded to the phone (especially * apk), but most of all, the uncertainty is confusing - is something really installed? No notifications, no warnings. Really 0-day?
The question is: what should be the steps to identify (if any) / eliminate malware in Android?

Answer 1

AdBlock+NoScript+Ghostery. Somehow I haven’t watched advertising for a long time and slops are not downloaded.

Answer 2

The browser in android does not have a "save file, yes / no" dialog - if the site insolently pushes you into .apk, it will be downloaded. However, automatically, without confirmation by the user, it will not be installed, especially without the "installation from unsafe sources" checkbox.
The fact that you couldn’t find it is not surprising, sometimes I also can’t remember where it downloads :)
Complaining that in android you can download a file that the server gives is like complaining, for example, that a car without a handbrake on can leave a non-horizontal parking lot.