So you don't need physical access you just need to install a malicious application? Okay then.

Why can one application even explore and access the views of another?