Google and Microsoft confirm new CPU security flaw