Mozilla Core Services disclosed a bug submitted by zhero_: https://hackerone.com/reports/1976449 [Source]