Google noted the patch (CVE-2020-0069) in its March Android security bulletin. While this is the first public disclosure, details about the exploit have been online for months. The vulnerability is still exploitable on dozens of device models, and hackers are actively using it. Worse, in all likelihood, many devices will never get the patch at all.

Hackers that use the exploit can cause damage in a number of ways. For instance, they could install any app and then grant it whatever permission it needs to hack the device. In the wrong hands, root access can empower ransomware and hypothetically make an entire device inoperable.

MediaTek has had patches available to fix this vulnerability since May 2019, but the company can’t force OEMs to fix their devices. Google, however, can force many OEMs to do so, through license agreements and program terms, XDA explains. Still according to XDA, Google knew about the vulnerability months before it took action. That’s especially disconcerting considering how widespread and dangerous the flaw is.

Engadget has reached out to Google for comment.