Zero-Permission Manipulation: Can We Trust Large Multimodal Model Powered GUI Agents?

Yi Qian , Kunwei Qian , Xingbang He , Ligeng Chen , Jikang Zhang , Tiantai Zhang , Haiyang Wei , Linzhang Wang , Hao Wu , Bing Mao

🏛 Institutions: National Key Laboratory for Novel Software Technology , NJU , Honor Device Co. , Ltd. , Institute of Dataspace , Hefei Comprehensive National Science Center
📅 Date: January 18, 2026
📑 Publisher: arXiv
💻 Env: Mobile
🔑 Keywords: security attack Android Action Rebinding verification gates

TLDR

This paper introduces Action Rebinding, a zero-permission Android attack that exploits the observation-to-action gap in multimodal GUI agents by changing foreground UI state before the planned action executes. Across six agents and 15 tasks it achieves 100% atomic rebinding success, and with intent alignment can also bypass confirmation-style verification gates.

Open paper arXiv Report issue