Security researchers say the bug could have allowed attackers to remotely plant malware on a victim’s smartphone during a video call.