> Isn't that how most every exploit and virus seen on Android work? Actually, no. Stagefright was about exploiting holes in the parsing of malformed media file

> Isn't that how most every exploit and virus seen on Android work? Actually, no. Stagefright was about exploiting holes in the parsing of malformed media files (no installation required). Tons of other vulnerabilities were of the form "thing that shouldn't be accessible via JavaScript in the browser/WebView is". Not that there isn't malware that spreads via installation, but Google's "Verify Apps" service (for sideloaded apps) has been quite effective: http://googleonlinesecurity.blogspot.com/2015/04/android-security-state-of-union-2014.html http://googleonlinesecurity.blogspot.com/2015/04/android-sec...