With more than 2 billion users, Android has a staggering number of devices to protect. But a "high-severity" bug that went undetected for more than five years\u2014that attackers could exploit to spy on a user and gain access to their accounts\u2014serves as a reminder that Android's impressive open source reach also creates challenges for defending a decentralized ecosystem.