I was wondering if it was possible to have an android app which is already installed go and download another app and install it? I figure there could be security problems with this, but is it possible for the Android OS to do this?
Strictly speaking no, it is not possible: each Android package (.apk) file installed on the device is given its own unique Linux user ID, creating a sandbox for it and preventing it from touching other applications.
If an application would "install" another one, it couldn't give to the target a new user ID. Only the system applet, running at root level, can do that.
What the application can do is to indirectly invoke the package installer with the
ACTION_VIEW intent and the
application/vnd.android.package-archive MIME type: the system will launch the appropriate "viewer", which of course is the package installer.
Nice link about that topic: http://android.amberfog.com/?p=98