I agree that it's an interesting problem, unfortunately client security is also a very hard one. While an emulator check sounds like a neat approach, it is hard

I agree that it's an interesting problem, unfortunately client security is also a very hard one. While an emulator check sounds like a neat approach, it is hard to prevent things like that from ending as just another cat and mouse game. They'd have to run every major+minor version, and then what if the author just set it to not infect the first 1000 installs, or to only activate if another semi-common app was installed, or simply included a chrome frame that pulled an exploit only if the client was on a major mobile network, etc. Most (though not all) malware detection, be it signature or behavioral relies on an engineer having analyzed it or a close relative in the past. When you have a sandbox model like Android, you really need to focus on getting exploits fixed on all your clients as a first priority. Until you get that straight you're never going to be doing much more than sticking your finger in the dike. Right now every 2.2.x or older client is wide open to a drive by compromise when using chrome lite. So focusing too much on the marketplace may not be rational. All recent mobile Safari builds are vulnerable to a similar webkit exploit as well. Both issues were cleared in Chromium last year.