Looking for WiFi everywhere is quite common for our mobile phone control. If you find that WiFi is available and you have selected a browser connection, you may have already done so when the browser appears on a Web page.
Also, when your phone uses some free apps, it often pops up some ad pages, which you might also recruit if you use web-front technology, especially JavaScript.
It all comes down to JavaScript's remote Code execution bug (cve-2012-6636) in the Android Addjavascriptinterface API, which allows JavaScript code to gain greater access to the system. When the app runs for the first time, they download JavaScript libraries over HTTP. That is, apps often don't safely download unverified JavaScript code that runs in an environment that can execute arbitrary code.
Although privilege elevation is common on Android (with the "root" permission of the device), remote code execution is also a rare and much more dangerous vulnerability that allows an attacker to execute specific code on a user's device without authorization.
We should get into the habit of "Remote Code Execution" and "root privilege" on a severity level, because a determined hacker could jump from one place to another and gain full control of the device.
In layman's words, avoid similar scenarios with at least the following two measures:
1) Upgrade the system to Andorid 4.2 or more
2) Minimize use of apps that contain third-party advertising
A typical Android hack scenario
