Proof-of-concept code for exploiting a Google Android master key vulnerability that can be used to Trojanize legitimate apps is making the round on the Internet.