Mozilla Core Services disclosed a bug submitted by astrounder: https://hackerone.com/reports/2053396 [Source]