“BLASTPASS” bug can install malware without user interaction.