Site sends costly sms without asking for permission
It sounds like they tried to force you to send SMS messages through a rogue telecom operator, which is essentially stealing money through text messages.

This exploit, it's not out of the question, necessarily. There was an article not too far back about how you can 'jailbreak' an iPhone by clicking on a link. The vulnerabilities are different, though, and I'm not really sure how they manage to find a hole to send a text message with.

Ideally, you should try to update to Android Marshmallow or Nougat (when it launches in earnest), or an equivalent version of Cyanogenmod, so you can get permission-by-permission control on your applications.

I can't say this is explicitly an answer to whether it's possible or not. At best, you've found an exploit that's already been patched. At worst, you've found an unpatched exploit that's being taken advantage of.