To actually enable the bug an application need to call GeolocationProvider::update() and a config file that enable the action but the mean we always have an exploitable code flow in the system.
This will remain dormant until activated by some service.
