Local privilege escalation via permission-review tapjacking

Improper UI-layer restriction in Android 10, 11, 12, and 12L allows local users to grant another app permissions through tapjacking. ReviewPermissionsActivity.onCreate permits an overlay to obscure the permission-review interface for a separate app targeting an API level below 23, so taps approve permissions for that app. Exploitation requires user execution privileges and interaction with the overlaid prompt, resulting in local privilege escalation for the attacker-controlled app.