The malicious app required to make a “Pixnapping” attack work requires no permissions.