Android's attack surface is much higher than Chrome OS's. On CrOS I can usually get away with running questionable NaCl code because the NaCl runtime sandboxes what it can do, and on top of that, the browser itself is sandboxed by the kernel. On Android, questionable apps have direct access to the entire kernel system call interface, as well as to other OS features.
Personally, I'm not so much upset because Android is uncommonly bad (it's like any other system that gives untrusted users non-root access to Linux: you can probably get away with it, but eh), but because CrOS is uncommonly good.
Personally, I'm not so much upset because Android is uncommonly bad (it's like any other system that gives untrusted users non-root access to Linux: you can probably get away with it, but eh), but because CrOS is uncommonly good.