Vulnerabilities plaguing Google Play and some Android Web browsers can be exploited by an attacker to remotely execute arbitrary code on smartphones, researchers warned on Tuesday.