A Dolby decoder flaw lets hackers run code via audio files on Android and Windows devices with no user action required.