The title is misleading, they found 24 vulnerabilities in Android _apps_ not in Android itself. That's a big difference.

In their own words from the body:

> I’ve reported more than 20 vulnerabilities in Android applications