Notably, the app doesn't need to abuse permissions to perform this attack, which exploits existing Android APIs, pixel ...