Very cool write-up, and a nifty little vulnerability.

Something that's either not in the article, or which I missed, is how many Android phones in the wild are vulnerable.

Probably nearly all of them. Changing how Bitmap talks to ashmem doesn't really get a vendor anything.

All of them that aren't the expensive ones that Google sells.

On the 300€ price border, I am yet to get an Android device that had more than one single update.

This was part of the November update which as far as I know isn't even out yet.

It won't change the fact which devices eventually will get the update.