[1] https://source.android.com/security/bulletin/2016-10-01.html [2] https://www.zerodium.com/program.html
Actually, they should constrain it even more, given the poor state of kernel exploits and how the whole security updates doesn't happen across Android devices.
One of the more interesting exploit dissections I read was of a 2013 Pwn2Own exploit of Chrome on Android[0] good enough to earn the designer $50k. Long story short, a series of vulnerabilities are exploited through Javascript of a visited webpage eventually resulting in sending that Chrome's cookies to a remote server. Impressive effort, and certainly not good, but then again, how many people have any important cookies in their mobile Chrome? And how many websites will actually allow you to do something that is interesting to an attacker after you hijack somebody's cookies? Of course those bugs are long since fixed on all Androids, since it's in Chrome. Even if they were active, I still wouldn't worry much, because you can't get much interesting info unless you can get system/root permission and read the data of all of the other apps on the device.
Actually, if I was designing that as an actual attack, I think I'd send off the autofill info too. That ought to be possible for an exploit that can read the cookie jar, and it sounds much more likely to contain credit card info, home addresses, and other stuff an attacker might be able to monetize.
[0] https://docs.google.com/document/d/1tHElG04AJR5OR2Ex-m_Jsmc8...
"Presentation on Threats and Vulnerabilities in Android OS"
https://www.youtube.com/watch?v=CZAejnPrqJc
"Android: Protecting the Kernel by Jeffrey Vander Stoep, Google"
How many devices are there in the wild that have yet to be patched against stagefright? I bet it's over 50%
If you turn off Android's setting to only allow app installs from the play store, then install a sketchy third-party store and download a flashlight app with a huge permission list that scrapes your email address book and sends it off to Russia, is that really a hack? It's pretty tough to prevent that without locking the phone down even harder than the iPhone. Doesn't seem worth worrying much about to me.
Android seems to be pretty safe against more dangerous stuff like visiting a website or displaying a web ad installs an app, bypassing user approval. Or worse, doing something with root permissions. At least I haven't heard of anything like that. If it's out there, presumably whoever has found such exploits keeps them under wraps for high-value targets.
The Stagefright one sounded pretty dangerous, but I haven't heard of any large-scale attacks with it in the wild. Presumably carrier-level general protections against mass MMSing and specifically against payloads for that bug were effective.
Given the difficulties the Android rooting community seems to be having, it's hard to believe that a drive-by exploit could gain persistent root.