Pop-up vulnerability found in major browsers