There are two clear prerequisites for this attack to work against a victim on a mobile device:
An attacker controlled (evil) device within BLE range (< 100m)
A victim visiting an attacker controlled page
...
All major mobile browsers were found vulnerable, in this case the vulnerability is simply allowing FIDO:/ intents to be triggerable by a page. All fixes consisted in blacklisting such URIs from being navigable.
...
I would like to give special thanks to all the browsers teams for fixing this issue relatively quickly.
From the article:
...
...
So, I guess it's fixed.