Android Toast Overlay Attack: “Cloak and Dagger” with No Permissions
Palo Alto Networks Unit 42 researchers found that Android's Toast window (TYPE_TOAST) can be used to draw overlays on top of other apps without requesting the SYSTEM_ALERT_WINDOW permission, because the code path lacks both a permission check and an...