Alice is using a Pixel XL in 2023. Its last Android patch was in 2019, on Android 10, but she keeps up with play store updates. Other than this, she is reasonably security conscientious. She does not sideload strange apps, but could be tricked into visiting a malicious link before exiting out of it. She is not a high value target.
By 2024 Eve has hacked Alice's phone as a result of this outdated phone. What is the most likely mechanism?
Here are my speculations:
Visiting a malicious link at the same time there is a major browser vulnerability. This sandboxes the malware, unless there is a second vulnerability, a sandbox escape.
Receiving a malicious text message that exploits a Message app vulnerability.
Attack on the baseband processor.
Pleas correct me if I'm wrong, but I don't see any of these as being very likely.