We need to start just de-trusting CAs that do this crap. Yes, websites will break. That will put pressure on site owners to only choose responsible CAs, and that market pressure is the only thing that can solve this problem.
(For the obvious issue) WoSign's recent certificates are in the CT logs and they're promising to put in all their 2015 certificates as well, so they could be whitelisted.
Some people are also calling for every certificate they've ever issued to be added to the CT logs, but I doubt that'll happen.
Android 4+ allows you to disable certificates from the system Settings and root isn't required, so try that first if you want to manually mess with the certificates. The app won't work with Android 4+ anyway.
An app to manage security certificates on your phone also containing a version of the Android CACert keystore derived from Mozilla. If a certificate has recently become untrusted you can either install an update to this app or you can backup and remove certificates by yourself.