Delayed disclosure is irresponsible. Doubly so if the vulnerability is the same as an old one. Triply so if there is active exploitation going on. So yes, Google is evil, for not doing immediate full public disclosure 90 days ago.