Mozilla Core Services disclosed a bug submitted by m4y4nk: https://hackerone.com/reports/1992261 [Source]