This is why I think Chrome for Android is a big deal. The browser will always be one of the easiest ways run an exploit. With the browser tightly coupled with the OS, many old phones will never receive an update for it.

The WebView as attack target is a different story, though.