Researcher says flaw in Android creates phone risk