I am doing some reading about security on mobile applications because I found an article about Man in the Middle Attacks.
I saw in that article and in many other places (including security.stackexchange), that if the user installs a certificate of an unknown 3rd party, that 3rd party can exercise MitM attacks in other apps of the device.
Basically what I want to understand is why? How can this 3rd party certificate be a vulnerability on other apps? I want some understanding of how these certificates work in that regard.
I read about certificate authorities, root certificates, chain of trust and related matters, which makes me even more confused on how something "self-signed" would be a security vulnerability.
Can anyone give me a brief explanation on how/why this happens? Or even provide me with links/books with relevant information.