My reading of the vulnerability is that you have some app with few permissions, that then triggers installing an app with many permissions. The user is presente

My reading of the vulnerability is that you have some app with few permissions, that then triggers installing an app with many permissions. The user is presented with a confirmation dialog for this installation. However, the low-permission app can overlay a window on top of this dialog, showing any content it likes, and this window can be configured to pass touch events through. So the user thinks he is interacting with this overlay window but is in reality confirming the installation of the new app.