Mozilla Core Services disclosed a bug submitted by d0xing: https://hackerone.com/reports/2143408 [Source]