Metasploit < 4.19.0 - Command Injection via Malicious APK File
Rapid7's Metasploit msfvenom framework handles APK files in a way that allows for a malicious user to craft and publish a file that would execute arbitrary commands on a victim's machine.