The study is available here[0]. The gist is that an app can launder a request it isn't privileged to make through another app that is privileged and doesn't correctly check the intent sender. There are examples in Section 4.3.

[0] : http://people.cs.vt.edu/danfeng/papers/AsiaCCS-17-Yao.pdf