Two security teams are at odds over which Windows component is responsible for a new lower-risk vulnerability that could lead to personal information being disclosed.