Attackers hit React defect as researchers quibble over proof