A critical Microsoft UFO flaw lets remote attackers view and control Android devices without authentication or user interaction.