Comment by Rygian

Now that you mention malice, here's a smoking gun, from the linked bug report:

> (it's not an issue with Firefox's implementation. This can be demonstrated by spoofing the useragent as a Chromium-based browser and attempting the same login flow […]).