A vice president of the mobile-security firm Zimperium recently revealed that 95 percent of all Android phone owners are vulnerable to malware attacks due to flaws in the media processing software—unfortunately named "Stagefright"—that Google has used in its mobile operating system for the last five years. More troubling still, those attacks can be triggered without any action from a phone's user.

According to Zimperium’s Joshua Drake, a hacker could conceivably hide a virus in a video file, text the video to your phone number, unleash the virus via the Stagefright software, and remove the text message without you knowing about it. Once that happened, the hacker could silently access your photos stored on SD cards, Bluetooth radio, and the phone’s audio and video recording functions.

Drake informed Google of his discovery in April and the company responded to the threat within 48 hours, using patches supplied by Zimperium. “Patches have already been provided to partners that can be applied to any device,” Google informed Android Central. However, in the intervening months, Google’s Android partners have been slow to provide those patches to consumers.

Silent Circle patched its Blackphone and Mozilla eliminated the flaws in version 38 of its Firefox browser, which uses Stagefright to play videos, Zimperium reports. According to Forbes, HTC has addressed the issue in all projects released since early July. But most of the 950 million at-risk users remain vulnerable to attack because of slow responses from other smartphone makers and cell service providers.

News of Drake’s discovery comes less than a week after a team of security experts exposed similarly startling vulnerabilities in software installed in late-model Jeep Cherokees. Fiat Chrysler responded by announcing a voluntary recall for 1.4 million vehicles.

For now, if your phone runs Android 2.2 or later, we advise you to contact the manufacturer of your phone or your carrier to inquire about patches for your phone. To learn more about data theft, read our report about why your secrets aren’t safe online.

—Chris Raymond

More from Consumer Reports:
Best cars for making it to 200,000 miles
6 costly estate planning minefields and how to avoid them
Best places to buy large and small appliances

Consumer Reports has no relationship with any advertisers on this website. Copyright © 2006-2015 Consumers Union of U.S.