They say Google is working to address it, so presumably this is still an issue in the current shipping version of Chrome (eg: on Nexus 5)? So then the interest

They say Google is working to address it, so presumably this is still an issue in the current shipping version of Chrome (eg: on Nexus 5)? So then the interesting thing is whether it is also an issue in the new WebView which is Chromium based. If it is, then it is actually burned into the ROMs and requires an OTA to address. By far my biggest problem with the Android update situation is that security issues are baked into ROMs on locked phones and consumers have literally no physical way to protect themselves against vulnerabilities that are discovered. Google's own phone, the Nexus One, has not received an OTA since October 2011, which must surely mean it has some serious security flaws discovered by now. I think Google is very lucky that a persistent, widespread security epidemic has not occurred based on one of these "baked in" flaws.