It turns out that Java has a security flaw that is currently being exploited to put malware on people's computers. Is there any risk that advertisements in Android apps will have embedded, malicious Java code in them? If so, how can I make sure to update whatever runs the Java in those ads once Oracle releases a security patch?
Apps for Android are compiled into a dalvik, machine code like format before they can be run on the device.
This means that everything is compiles, and things like Java etc cannot be updated on the device - as the device doesn't actually use Java.
It could be possible for malicious code to be installed into an Android app, however Google Play does check all apps for malicious code on upload, so you should be safe as long as you download from Google Play.