Flaw in Safari browser’s API implementation lets user files to be stolen