Google’s Threat Analysis Group (TAG) reported the flaws