zero-click flaw