A researcher has discovered a potentially dangerous, password-stealing vulnerability in Apple's Safari browser.