A zero-day security flaw was finally addressed by Google in the June Pixel Feature Drop, but that only covers Pixel devices. Everyone else is left out in the cold.
Android Central