Researchers found a bug where websites could create a hidden ID and track users even in Private Mode.