[0x0]

Are Android or iOS affected? Android seems to ship openssl 1.0.

Could a malicious server attack clients? Perhaps expose a browser's cookie jar or other saved passwords in memory?

The number of installed openssl clients across all devices and computers must be quite large.

[lxgr]

It seems that Android has dodged this bullet by compiling OpenSSL with NO_HEARTBEATS: https://twitter.com/agl__/status/453472368589942785

[welder]

Yes, the vulnerable code is used by both client and server so any client using openssl is affected.

[biafra]

Which parts of Android really use OpenSSL to do TLS with this heartbeat feature enabled?

The browsers? All Apps running on Dalvik? All apps running on ART?

[hrrsn]

OpenSSL doesn't seem to be installed on my jailbroken iPhone.