>They collect a range of sensitive information such as location, texts and calls, as well as audio and video. This sentence ruins the credibility of the article because Android doesn't let you do this. The camera, microphone, can only be used when an app is in the foreground. For location data being tracked in the background it will have a persistent notification telling the user that an app has your location. For an…
For example, with respect to the camera, they documented a "standard" way to abuse Android APIs to do it (create a Preview, which unlocks the camera, but hide it in a 1x1 or transparent element), and two "new" ones --- raw frame access with `SurfaceTexture`, and creating a 1x1 WebView.
When you see articles like these at university sites, they're virtually always announcing a paper that got accepted somewhere, and you need to read the paper and ignore the press release.