Which Android permission, if abused by malware, allows it to draw UI elements on top of any other app and is a key enabler of overlay phishing attacks?

Why D is correct

SYSTEM_ALERT_WINDOW (also known as 'Draw over other apps') allows an app to display content over any other app using window type TYPE_APPLICATION_OVERLAY (Android 8+). This is the technical enabler for overlay phishing attacks where a fake login screen is drawn over a legitimate banking app. INJECT_EVENTS is a signature-level permission not available to third-party apps. BIND_ACCESSIBILITY_SERVICE enables reading screen content. FOREGROUND_SERVICE enables persistent background processes but does not enable drawing over other apps.