Nearly 1 billion smartphones worldwide could be vulnerable to a critical flaw that allows hackers to steal PIN codes in less than a minute.