--- a/toolkit/components/places/AsyncFaviconHelpers.cpp
+++ b/toolkit/components/places/AsyncFaviconHelpers.cpp
@@ -577,16 +577,22 @@ AsyncFetchAndSetIconFromNetwork::OnStart
 
 NS_IMETHODIMP
 AsyncFetchAndSetIconFromNetwork::OnDataAvailable(nsIRequest* aRequest,
                                                  nsISupports* aContext,
                                                  nsIInputStream* aInputStream,
                                                  uint64_t aOffset,
                                                  uint32_t aCount)
 {
+  const size_t kMaxFaviconDownloadSize = 1 * 1024 * 1024;
+  if (mIcon.data.Length() + aCount > kMaxFaviconDownloadSize) {
+    mIcon.data.Truncate();
+    return NS_ERROR_FILE_TOO_BIG;
+  }
+
   nsAutoCString buffer;
   nsresult rv = NS_ConsumeStream(aInputStream, aCount, buffer);
   if (rv != NS_BASE_STREAM_WOULD_BLOCK && NS_FAILED(rv)) {
     return rv;
   }
 
   if (!mIcon.data.Append(buffer, fallible)) {
     mIcon.data.Truncate();