Security researcher discloses Safari bug after Apple delays patch