Android smartphones running Lolipop, Marshmallow, and Nougat, are vulnerable to an attack that exploits the MediaProjection service to capture the user’s screen and record system audio. Currently this problem affects around 77.5% of all Android devices.
The vulnerability reside inn the MediaProjection service. The service is used to capture screen content and record system audio. Google opened this service to any one starting with Android Lolipop (5.0). The problem is that Google didn’t put this service behind a permission that apps could require from users.