A bug in the Android mobile operating system has been discovered by researchers, who say it affects nearly a billion devices.
The flaw can be exploited by sending a photo or video message to a person’s smartphone, without any action by the receiver.
Google said it had patched the problem, but millions of devices still need their software updating.
The researchers said the flaw was “extremely dangerous”.
Researchers from US information security company Zimpherium said they believed it was one of the worst Android vulnerabilities to date, estimating that 950 million devices were affected.
Hackers were able to send malicious code within a multimedia message that could access a service within Android called Stagefright.
After Stagefright had been invoked, which required no action from the victim, other data and apps on the handset could be accessed by the malicious code.
“These vulnerabilities are extremely dangerous because they do not require that the victim take any action to be exploited,” the researchers wrote.