Yes, it is very simple. I would frame it as this:
Your protagonist has tracker app installed on her own phone, so that if someone robbed her phone she could track it, block it, etc. This way, you explain why she is already familiar with that app. She would have investigated the available apps months ago when she bought her expensive phone (or she was recommended it by someone else). Clearly, you wouldn't want to spend some precious minutes looking at dozens available apps in the market rather than escaping.
When she gets hold of the phone, she opens the market and installs the same app she has on her own phone (she knows its name, so she goes directly to that), and logs in with the credentials of her online account (so that the kidnapper's phone gets linked to her account, and she can thus spy as she would with her own phone). It can be done very quickly.
As you are making up the spy app, you can also decide which features it offers, but showing an innocuous looking icon and name so that it passes as something else (when the robber looks at it) is not an uncommon one. Your kidnappers probably have lots and lots of apps installed, so they don't notice a new one.
So, focusing on your questions:
Is there a way for her to install some kind of app or something in the kidnapper's phone that can enable her to track it undetected?
Yes
I know there are spy apps out there, but not sure if it's feasible to download anything in her situation.
It would be feasible. I think the hard part is to explain how they left their phone unattended so that their victim could grab it, and how she could access it.
Note that letting her grab even a locked phone would be critical for a kidnapper, since an emergency call doesn't require unlocking the phone.
I would make it so that the kidnapper used the phone in front of her and she could the used passcode to unlock it (maybe the kidnapper complained that it is not recognizing their fingerprint? Or it would usually use FaceID to unlock their phone, but now they are wearing a ski mask in front of her?). The passcode could be a series of points that make a letter (which she later finds it's the kidnapper's initial), or maybe their birth year (or that of a child).
Once she is able to get the passcode to unlock the phone, installing an app would be no trouble. (Realistically, she'd better call/message the cops, but maybe she was not be thinking clearly...)