The vulnerability could theoretically allow bad actors to track the locations of millions of phones in law enforcement databases.