Play Services have a way to install applications in the background (<a href="http:&#x2F;&#x2F;stackoverflow.com&#x2F;questions&#x2F;23695170&#x2F;how-to-install-applications-programatically-without-opening-play-store-as-googl" rel="nofollow">http:&#x2F;&#x2F;stackoverflow.com&#x2F;questions&#x2F;23695170&#x2F;how-to-install-a...</a>) that does a signature check, and refuse to work if the request didn&#x27;t come from a Google App. Maybe they found a way to call that from Chrome&#x27;s v8?<p>What makes me think so is that they claim to have installed a &quot;BMX Game&quot; (which I guess is on the Play Store), and I don&#x27;t see any claim of it being automatically launched after the installation (Android &gt;2.3 should block that).<p>That would be much better for Android than the alternatives. As far as I can tell, applications can only install stuff in the background if they are system applications (live into some &#x2F;system subfolder, which Chrome does when preinstalled&#x2F;installed from a GAPPS package) AND declade the &quot;INSTALL_PACKAGES&quot; permission in their manifest (Chrome doesn&#x27;t).<p>That should be the only way, apart from getting root (but I guess they would have just said &quot;we got root&quot; then).<p>EDIT: Obviously all of this is just a guess. I&#x27;m just happy that there is no Chrome on my phone :) (but the WebView on Android 5.1 is based on Chromium - so i wonder if that&#x27;s exploitable as well?)