Mozilla Core Services disclosed a bug submitted by avram: https://hackerone.com/reports/1913263 [Source]