Mozilla Core Services disclosed a bug submitted by lamscun: https://hackerone.com/reports/1888545 [Source]