So much for the Bouncer
While the ads are downloaded, the code to open a hidden browser window, download a web page and render it, then show it over everything else is inside the original app. Very few apps legitimately need to do things like that and the page can be set to do anything in the future.
Why are we putting our faith in what is probably a giant regex string at Google's end?
Biting the hand that feeds IT
