Hundreds of millions of Android phone cameras can be hijacked by spyware.

Rogue Android apps can hijack the default camera apps on Google and Samsung smartphones, and probably the camera apps on many other brands of Android phones, to take photos and record video and audio without the device users’ permission.

The apps can also view phone locations and other apps’ files, turning the phones into perfect spying devices. Even the best Android antivirus apps might not be able to protect you.

This flaw has been patched in Google and Samsung devices, according to Checkmarx, the Israeli security firm that found the vulnerability. But it’s not clear how many other phone makers have taken similar steps.