Android security flaws that allow malicious folk to fling apps onto phones without the user’s knowledge have been revealed. A study of HTC phones found that the integrated web browser can install software packages without the user being aware of it. That’s to allow HTC to automatically update the Flash Lite plug-in but also gives a way in for bad guys too.