Cannot be this a potential leak of information?

I can create a non certified app defining this activity and get access to a mozcontact without asking for the priviledged permission.