Comment by charcircuit

3 days ago

From the article:

>To gain these elevated privileges, Pixel IMS uses Shizuku, an open source Android app that lets other apps run processes as the shell user.

It's possible for an app to use wireless debugging to debug the phone it's running on to get shell permissions.