Two Android security vulnerabilities are being actively exploited by cybercriminals, posing risks of spyware installation.