Mozilla Core Services disclosed a bug submitted by holybugx: https://hackerone.com/reports/2194289 [Source]