I don't pay a lot of attention to the Android OS, but I do recall there was a nasty exploit discovered about a year ago (called Stagefright) where a specially-crafted text message with a picture or image can cause malicious code to be run on the phone the moment the phone receives the message.