Mozilla Core Services disclosed a bug submitted by unexpectedbuffercon_: https://hackerone.com/reports/1879548 [Source]