MetaMask disclosed a bug submitted by ronnyx2017: https://hackerone.com/reports/1651429 – Bounty: $1000 [Source]