Google-protected mobile browsers were open to phishing for over a year