The most alarming aspect is that this vulnerability was reported to Google 4 years ago - and nothing happened. https://iliana.fyi/blog/acropalypse-now/