sh.itjust.works doesn’t have custom emojis and so is fairly safe from this specific exploit. Only local users of instances with custom emojis were at risk if they had visited a malicious page on their home instance.
Lemmy-ui pushed a fix for this vulnerability just 8 minutes ago, so we’ll see if that makes it here.
It’s what struck me when I switched to Android… the play store is awful. Good on Apple, hopefully Google will follow suit.