Comment 3 for bug 1949115

I filed it as a private bug because I wasn't sure how widely known it was that this was exploitable, but sure if the security team thinks this is a well-known issue that is good enough for me