H1 disclosure: https://hackerone.com/reports/131792 Only applies to 8.7 and 8.6.