I've recently discovered that the Magic Leap app allows any app to track user's eyes without asking permission. This can be used for a wide variety of malicious purposes such as determining the user's sexual orientation for blackmail purposes (see https://www.vice.com/en_us/article/bj9ygv/the-eyes-are-the-prize-eye-tracking-technology-is-advertisings-holy-grail ).

I submitted a responsible disclosure to Magic Leap through BugCloud but was told that this does not qualify as a vulnerability, so I would like to warn people directly to NOT trust any Magic Leap app, and to please try to petition Magic Leap to make eye tracking require asking permission, rather than being automatically granted.