Researchers have discovered an alarming security flaw that could let some Android apps spy on users without their knowledge.