&gt; Isn&#x27;t that how most every exploit and virus seen on Android work?<p>Actually, no. Stagefright was about exploiting holes in the parsing of malformed media files (no installation required). Tons of other vulnerabilities were of the form &quot;thing that shouldn&#x27;t be accessible via JavaScript in the browser&#x2F;WebView is&quot;.<p>Not that there isn&#x27;t malware that spreads via installation, but Google&#x27;s &quot;Verify Apps&quot; service (for sideloaded apps) has been quite effective:<p><a href="http:&#x2F;&#x2F;googleonlinesecurity.blogspot.com&#x2F;2015&#x2F;04&#x2F;android-security-state-of-union-2014.html" rel="nofollow">http:&#x2F;&#x2F;googleonlinesecurity.blogspot.com&#x2F;2015&#x2F;04&#x2F;android-sec...</a>