Occam says that the security researcher has notified critically affected parties through the normal channels and Mozilla and others are embargoed from talking about it until its been fixed?