javascript exploit fixed