Serious security flaws that could give attackers complete access to a phone's data have been found in software used on tens of millions of Android devices.