Ad SDKs exploit OS bugs to get location data. These specific ones have since been patched, but historicaly they read ARP tables, EXIF geo tags, and colluded with other apps that legimately had location permissions to get that info. It wouldn't surprise me if there are other live exploits quietly being used today. https://www.usenix.org/conference/usenixsecurity19/presentat...