True, but you have to download the malicious app from the app store. Here Google has a good track record of removing them from their store. Also, the user can e

True, but you have to download the malicious app from the app store. Here Google has a good track record of removing them from their store. Also, the user can exercise some common sense by not installing apps from untrusted sources. If the users does not pay attention to the app's permissions, any app could be harmful without needing a browser exploit.