Several hours later, Google star vulnerability researcher Tavis Ormandy tweets(!) an embarrassing drive-by RCE in Aviator.

This bug was reported many months ago (though at that point it wasn't clear that it was actually a RCE). see:

In early 2014, the "Error138" is reported and disclosed first time.