Original text:
These flows are increasingly popular and typically involve using a mobile phone to scan a QR code or enter a user code displayed on an <del> initiating device (e.g., Smart TV, Kiosk, Personal Computer etc). </del>  The channel between the Initiating Device and the Authorization Device is unauthenticated and relies on the user's judgment to decide whether to trust a QR code, user code, or the authorization request pushed to their authorization device. <del> Several publications have emerged in the public domain (Exploit1, Exploit2, Exploit3, Exploit4, Exploit5, Exploit6), describing how the unauthenticated channel can be exploited using social engineering techniques borrowed from phishing.  Unlike traditional phishing attacks, these attacks don't harvest credentials.  Instead, they skip the step of collecting credentials by persuading users to grant authorization using their Authorization Devices. </del>  Once the user grants authorization, the attacker has access to the user's resources and in some cases is able to collect access and

Reviewer comments:
Introduce the Cross-Device Consent Grant label (see )
e.g. Malicious Context Change Authorization Request or something like that.
Ideas from Pieter's slides: Illicit Consent Grant Attack? Describes outcome, not the mechanism Attacker-in-the-Middle Attack? Describe attacker capability, but both too broad and too narrow Authorization Context Manipulation Attack? Describes the mechanism Authorization Context Manipulation Exploit Describe mechanism, hints that protocol functions as expected. What about "Phishing for Consent"? Describes the mechanim which depends to some extend on social engineering (phishing) Describes the outcome (consent) Other names shared via e-mail by George Fletcher: Zishing Azishing "Cross-Device Authorization Exploit" "Social Engineering Token Theft" "Authorization Flow Manipulation Exploit" FlowJack AuthJack TokenJack Context Manipulation Authorization Exploit Permitphishing, Authishing
"Cross-Device Consent Phishing"?
Some references on Consent Phishing: URL URL URL
CDCP - Cross Device Consent Phishing - the abbreviation works well.
Two editorial nits, the rest looks good to me! Thank you!

Revised text:
These flows are increasingly popular and typically involve using a mobile phone to scan a QR code or enter a user code displayed on an  <ins> Initiating Device (e.g., Smart TV, Kiosk, Personal Computer etc). </ins> The channel between the Initiating Device and the Authorization Device is unauthenticated and relies on the user's judgment to decide whether to trust a QR code, user code, or the authorization request pushed to their authorization device.  <ins> Cross-Device Consent Phishing (CDCP) attacks exploit the unauthenticated channel between the Initiating Device and Authorization Device using social engineering techniques to to gain unauthorized access to the victims data.  Several publications have emerged in the public domain (Exploit1, Exploit2, Exploit3, Exploit4, Exploit5, Exploit6), describing how the unauthenticated channel can be exploited using social engineering techniques borrowed from phishing.  Unlike traditional phishing attacks, these attacks don't harvest credentials.  Instead, they skip the step of collecting credentials by persuading users to grant authorization using their Authorization Devices. </ins> Once the user grants authorization, the attacker has access to the user's resources and in some cases is able to collect access and