Google’s latest annual review of zero-day exploits has claimed known vulnerabilities could be even worse than zero-day vulnerabilities.
In its report, Google asks whether zero-days are even needed on Android. Typically, a vulnerability would be most concerning before it becomes public. During this (hopefully short) period, an attacker can execute exploits without having to worry about a patch.