fix item 5 from report by Ivan Fratric of the Google Security Team