Bug opens up Javascript browsers to hackers