So the Hangouts bit is just about triggering the problem without user intervention? If an attacker can find another way to get you to play a malicious video, there's still a hole? That's clearly more serious.
In my experience, people will open a message just to clear the notification and that's all that it would take for them to be compromised.