Just spent a little while googling around for Android security info, and I'm feeling pretty safe. I haven't been able to find any reports of anybody actually doing anything interesting off of the Stagefright exploit. Sounds like Android is pretty good at defense in depth. Though Stagefright is bad, it sounds like getting from whatever it does to anything interesting to any potential attackers is not easy, and if anybody knows how to do it, they aren't talking about it or using it widely.

One of the more interesting exploit dissections I read was of a 2013 Pwn2Own exploit of Chrome on Android[0] good enough to earn the designer $50k. Long story short, a series of vulnerabilities are exploited through Javascript of a visited webpage eventually resulting in sending that Chrome's cookies to a remote server. Impressive effort, and certainly not good, but then again, how many people have any important cookies in their mobile Chrome? And how many websites will actually allow you to do something that is interesting to an attacker after you hijack somebody's cookies? Of course those bugs are long since fixed on all Androids, since it's in Chrome. Even if they were active, I still wouldn't worry much, because you can't get much interesting info unless you can get system/root permission and read the data of all of the other apps on the device.

Actually, if I was designing that as an actual attack, I think I'd send off the autofill info too. That ought to be possible for an exploit that can read the cookie jar, and it sounds much more likely to contain credit card info, home addresses, and other stuff an attacker might be able to monetize.

[0] https://docs.google.com/document/d/1tHElG04AJR5OR2Ex-m_Jsmc8...