[Stephen Cerruti]

It's some Android OS error (like it doesn't know how to play the stream)

This is exactly correct. Android doesn't natively handle these formats to protect the content from unauthorized distribution.

 

[Stephen Cerruti]

This is making use of the same hack we've seen previously. Find an existing app that provides a web browsing widget that allows you to change the webpage.

Since the vulnerability is in an existing video app, it should only work when parked. Is that correct?