Not too surprising, considering the level of complexity in a modern browser and javascript engine I suppose. I wonder if the next generation of phone operating systems will have something more akin to a true exo or micro kernel to help mitigate these sorts of attacks.