The good news is that this is not something a random website or public Wi-Fi network can do to you. An attacker would still need to get a specifically crafted app onto your device first. The bad news, especially for journalists, activists, and anyone relying on Android’s lockdown mode as a hard guarantee, is that Google has decided not to fix it.

Of course, google doesn’t need to patch it. You’d need a malicious application installed and google is going to be the gatekeeper on everything I’m allowed to install. /s

My next phone will absolutely be running Graphene OS. My current Sony has been ADB’d as best I can over the past year, and still not even close to Graphene.