Mozilla Critical Services disclosed a bug submitted by supr4s: https://hackerone.com/reports/2209130 [Source]