Bugs discovered by Google’s Project Zero can be exploited with no user interaction to execute malicious code – with one flaw still remaining to be fixed