I think security bugs in Dalvik have less ramifications, because of at least 2 reasons: 1. Java code doesn't get executed by Dalvik automatically from web site

I think security bugs in Dalvik have less ramifications, because of at least 2 reasons: 1. Java code doesn't get executed by Dalvik automatically from web sites etc - an attacker has to get the user to install his application. 2. If an attacker manages to get the user to install and run his application, Dalvik security bugs are close to useless to him because Android applications can load native code without needing permission from the user. His problem is going to be circumventing the restrictions enforced by the kernel and system daemons running on the system. Android doesn't enforce permissions at the JVM level AFAIK. To clarify here I meant vulnerabilities in the JVM that have to be triggered by malicious Java bytecode. Vulnerabilities which make applications themselves vulnerable are more problematic of course.