There's an HTML5 API for vibrating devices, including phones; this isn't necessarily an Android-specific problem, and there are legitimate reasons for browser content to use features like vibration. (It isn't implemented in Safari, but it apparently works in other browsers on iDevices.)
The Play store launching without permission I haven't seen, so I can't guess at.
The Play store launching without permission I haven't seen, so I can't guess at.