Mozilla Core Services disclosed a bug submitted by nicholas_cw: https://hackerone.com/reports/2109320 [Source]