Mozilla Critical Services disclosed a bug submitted by anish_kosaraju: https://hackerone.com/reports/1989901 [Source]