> There’s just one snag: there is no patch yet.

But they knew about the issue since 9th of April. This looks a lot like those "Apple fixed a CVE, Mozilla fixed a CVE" type of "issues".