Critical Android bugs present in older devices now targeted by malvertising campaigns and other drive-by exploits
Dan Goodin / Ars Technica :
Context & Ripple Effects
This story lands mid-arc in Android's patching crisis. A year earlier, a study of 20K devices found 87% vulnerable because manufacturers failed to deliver patches, and the public release of Stagefright exploit code turned those unpatched phones into standing targets. What changed by April 2016 is the delivery mechanism: rather than requiring users to install a malicious app — the route of the adware that hijacked the Accessibility Service — malvertising and drive-by exploits now reach vulnerable handsets through web browsing itself.
First-order effects
- Owners of older, unpatched Android devices face exposure from ordinary web browsing, since drive-by exploits need no app install or user permission to land.
Second-order effects
- The malvertising channel pressures Google and device makers on update delivery, a gap the earlier 87% figure showed was structural rather than incidental; carriers and OEMs that lag on patches effectively decide which users stay exposed.
Third-order effects
- If exploit code keeps flowing into the open — as it did with Stagefright — the industry's response points toward security updates decoupled from carrier/OEM release cycles, since the alternative is a large installed base permanently exploitable at scale.
The trend: Android's fragmented update pipeline is turning aging devices into a persistent attack surface, with each publicly released exploit widening the pool of drive-by targets.