How though? Just did the vulnerabilities that allow that.

It's not a vulnerability necessarily, but "Display over other apps" permission allows malicious apps to intercept interactions like users entering passwords and trick them into performing actions (clickjacking).