At a glance, Firefox is vulnerable to this in multiple places.
Bug 1737470 Comment 5 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
~At a glance, Firefox is vulnerable to this in multiple places.~ Looking closer, since Firefox always specifies `SEC_OID_ANSIX962_EC_PUBLIC_KEY` and only accepts EC keys, it doesn't seem to be vulnerable to this.