There is always the possibility of a vulnerability in some app that could cause your computer/phone to be hacked. Browsers are notorious for having bugs that allow the computer to be infected with a virus simply by viewing a page. In fact, one method to jailbreak an early Apple iOS device was to simply browse to a page that delivered a payload via a bug in pdf (source).
Android mitigates this by having apps run in their own sandbox. Thus, an app that is compromised can only (theoretically) compromise its sandbox, which includes any permissions it originally was granted. If compromised, it couldn't send an SMS unless it had that permission originally, nor could it modify other programs' data. But even sandboxing is not foolproof.
If your phone is plugged in to a computer, it can be 'hacked'. This is proven by most rooting methods that use a bug to get root. Programmers could just as easily create a virus for computers that detects Android phones and installs a malicious app silently, or even roots them and takes over the phone completely.
This talk has some great details on app permissions. It isn't necessarily hacking, but it does show how an app with very few, seemingly innocuous, permissions can actually track and do a lot without you knowing.
In the end, your android device is a computer, with all the same inherent flaws that come with it. So like a desktop, if you are careful about where you browse and what you install, you'll likely be fine.