Comment by dns_snek

It's not a vulnerability necessarily, but "Display over other apps" permission allows malicious apps to intercept interactions like users entering passwords and trick them into performing actions (clickjacking).