Google initially denied the vulnerability, but has since backtracked and is working on a fix