What I'm talking about:

  • Facebook publishes a standalone app called Messenger on the Play Store. It's a chat app, for interactions with other Facebook users. It implements something called "chat heads" which are these round bubbles that sit on top of everything else in the Android UI (except the status bar) that allow for opening an Always On Top chat UI.

  • Facebook also publish their namesake app, which implemented intrusive notifications for itself, that appear at the top of the screen and contain their relevant content.

    They render on top of the system status bar preventing access to it when the app isn't active

These are benign examples but they intrude on userland and feel malicious in the way they manifest themselves -- appearing without warning.

Facebook gave its apps hidden ways to disable these things.

What surprises me is that there are not more apps that exploit these UI security "holes".

If I were in the business of infecting people's phones, I would take advantage of this and make the most infuriatingly annoying malware because it's as if one program is given control of the entire interface with no escape.

Imagine the things a malicious bit of code could do if it literally prevented the user from doing anything about it. They can't use the interface, so they can't kill the app, they can't turn off the phone and on many phones you can't remove the battery, etc.

Is there an obvious reason why this sort of thing isn't more exploited? I can't find much about it.

  • Just to add a bit more info, apps that are published to google play get reviewed, and as such any app that just fills a whole screen for no random reason, in my opinion, would probably not get put up onto the google play store and as such you don't get to see what you are talking about in your above question. But when installing from unknown resources this could happen, but when most user who install from unknown source, install applications, they would usually know what it does, and would intentional install a malicious app.
    – Matt07211
    Jan 22, 2016 at 2:28
  • @Matt07211 I know they get scanned and stuff for obvious glaring issues but do Play Store submissions actually get tested by humans?
    – cat
    Jan 22, 2016 at 2:30
  • 1
    To some degree yes, (to some extent any way). As seen here: techcrunch.com/2015/03/17/… Edit: Qoute: "Today, Android apps are approved in hours, not days, despite the addition of human reviewers."
    – Matt07211
    Jan 22, 2016 at 2:32
  • "and make the most infuriatingly annoying malware ever" But why? What use does that have? Malware isn't supposed to annoy, it's supposed to either get private information to the developer or to get you to pay the developer or (rarely) to completely destroy information or your ability to use the device. Just annoying you and making you reboot your phone does not do either of these things. And yes, you can always shut down your phone, no matter what happens. On some phones it's holding the power button for 8 seconds, on some it's power+volume down for ~2-3 seconds, on some others something else. Feb 15, 2019 at 12:10

2 Answers 2


That chat bubble is there because you granted Messenger the permission "draw over other apps". In simple terms, call it overlay. The qualified name of the permission is android.permission.SYSTEM_ALERT_WINDOW.

Allows an app to create windows using the type TYPE_SYSTEM_ALERT, shown on top of all other apps. Very few apps should use this permission; these windows are intended for system-level interaction with the user.

(Emphasis mine)

I don't think chat bubbles of Messenger, in any capacity, are meant for system-level interaction with its user, so you can assume that developers of that app and any such app chose to abuse the system's feature for their own interests.

Furthermore, you definitely are not the first person who thought about exploitation of the overlay feature of Android.

ArsTechnica: New Android ransomware locks out victims by changing lock screen PIN

Dubbed Android/Lockerpin.A, the app ... overlays a bogus patch installation window on top of an activation notice. When targets click on the continue button, they really grant the malicious app elevated rights that allow it to make changes to the Android settings. From there, Lockerpin sets or resets the PIN that unlocks the screen lock, effectively requiring users to perform a factory reset to regain control over the device.


Once the continue button is pressed, the app will acquire administrator rights [becomes a Device Administrator]. From there it will change the PIN and periodically continue to overlay a fake window in an attempt to hold on to the elevated privileges. It's the first known Android lock-screen ransomware to set a phone's PIN lock. Because it requires non-paying victims to factory reset their phones, it causes them to lose all of their data.

(Emphasis mine)

Just so you know, Android understands the potential damage overlay can cause to a device, hence, when an overlay is actively drawn on screen and user attempts to sideload an app, the install button simply fails to work. See Why can't I press the Install button when installing applications from unknown sources?

If only Android extends this feature to activation/deactivation of device administrators, that would be very nice of them.

In case, you want to know which other app has the same permission, you can use my answer on Determine which app is drawing on top of other apps?

The notifications you mentioned, intrusive they may be, are called Heads-up notifications. Until Android 5.1, users didn't have an official way to get rid of them without losing all notifications from an app.

Android Design: Heads-up Notification

When a high-priority notification arrives ..., it is presented to users for a short period of time with an expanded layout exposing possible actions.

After this period of time, the notification retreats to the notification shade. If a notification's priority is flagged as High, Max, or full-screen, it gets a heads-up notification.

(Emphasis mine)

As you may have guessed, Heads-up notifications are not the default type of notification a system should be displaying to a user and a developer have to explicitly opt for it in the app's code. It's just that some developers opine that the things their app do are of the ultimate priority in the life of the user, let alone the system, so they often choose to show every notification as a Heads-up notification.

That said, heads-up notifications were introduced only in Lollipop while your device runs Android KitKat, so definitely, as Andrew T. put it in comments, it must be Facebook's native code which is both creating and displaying those pseudo-Lollipop notifications at the top and above a window.

The reason you can't interact with system bar when that pseudo-Lollipop notification is active, is most likely the use of blocking overlays to display a view which is perceived as a notification by the user. Aaron's answer has explained it with a good working example app.

I searched web between the range Oct 2013 to Oct 2014 (the developmental age of Android 4.4.x) and came to know that there were apps available in Play Store primarily meant to create those pseudo-Lollipop notifications. One such app is Floatifications and the other one I found was Metro Notifications Free. Both uses the same blocking overlay to create those pseudo-Lollipop notifications.

I'm surprised you didn't find toasts pesky enough.

  • 1
    Regarding heads up notification, I'm a bit in doubt since OP mention Android 4.x which didn't have the feature, while he acknowledged it as "pseudo-Lollipop" notification. So.. If it appeared on KitKat, then I think it's FB's custom code...
    – Andrew T.
    Jan 22, 2016 at 7:24
  • @AndrewT. thank you. I missed that critical info. Please see if the edited answer clear your doubts now. Let me know if it doesn't.
    – Firelord
    Jan 22, 2016 at 11:38
  • Wow, nice answer! I would just like to note that I as an end user was not aware that Messenger had this specific permission that you mentioned because it's only recently in Marshmallow that Google realised they should improve their permissions model on apps, and it was not specifically mentioned or visible from the store.
    – cat
    Jan 22, 2016 at 13:22
  • I don't mind toasts because they typically take up a very small portion of the screen for a very short amount of time, and kind-hearted developers allow me to tap things behind them, so I'm alright with them as long as they don't overstay their welcome. What does feel pesky is when they refuse to go away and/or are the size of a cockroach. :)
    – cat
    Jan 22, 2016 at 13:24

Facebook does a lot more than just bloat your viewing window. Have you seen all of the permissions it requires?!

The methods Facebook use to add chat bubbles are called Blocking Overlays. They are built-in feature of Android. There's an app called Tasker that well visualizes these features. Tasker is an automation app, but you can also create activities called "Scenes" that you can design UIs on. Tasker allows you to display these scenes as:

  • Full Window Activities,
  • Blocking Dialogs (with a Dim Background option, which don't allow the user to click behind the window),
  • Blocking Overlays (which allow the user to continue using the foreground app, much like chat bubbles),
  • and non-blocking Overlays (these cannot be focussed or tapped on, taps go right through the overlay to whatever is underneath it).

Non-blocking overlays sound pointless, but that's how "night-mode" and "brightness limiter" apps are created. It's just a semi-transparent overlay on the screen.

So, it's not a super bad thing that apps can utilize your window space, if not abused, they can provide features. In the case of Facebook Messenger all the neat little features definitely has a cost, of privacy (app permissions).

I hope I helped explain these "UI hacks" a little better, and that they're not always bad.

  • I have seen all the permissions it requires and how terrible it is, but it's better than the website ¯_(ツ)_/¯ To respond to your last point/s, yes, they are useful for those cases and many others, I agree, but the implementations by FB still irk me. Thanks for your answer!
    – cat
    Jan 22, 2016 at 2:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .