fix item 9 from report by Ivan Fratric of the Google Security Team