Google publishes exploit code before patch, reported 29 months earlier, is fixed.