It sounds laborious, but it works quickly: a typical attack breaks into a phone within 20 seconds. And while it's most effective on a Nexus 5 with stock firmware, it's known to work on the customized Android variants found on phones like the HTC One, LG G3 and Samsung Galaxy S5.

This doesn't amount to an in-the-wild attack, and you'll be fine if you're running Android 6.0 Marshmallow or any other OS version patched against Stagefright. The catch is that relatively few people are in that boat -- most Android users are running Lollipop or earlier, and only some of those devices have Stagefright patches. You're probably fine if you own a relatively recent device, but your friend with a years-old Android phone is at risk.

Update: Google has provided a response that elaborates on what we knew: you're protected against this if your phone has least the October 1st, 2015 security update installed. Read the full statement below.