New URI bugs could steal user data