> I think the image display libraries and the web browser are still prime
> attack targets (written in C, note!). Think of an MMS message, spam email,
> or webpage that takes control of your phone. And of course emails or MMSes
> itself to all your contacts to continue propagation.
Remember that just because code is written in C, doesn't mean it's part of the trusted codebase.
For example, the Chrome web browser is sandboxed. So if you can buffer overflow a webkit HTML rendering thread (not a very hard task), you get control of... what is displayed on the screen. Nothing else.