Google patched a zero-day vulnerability that the company said it was used to install spyware made by a commercial surveillance tech vendor.