This issue (and other security issues related to expat) are tracked upstream at <https://bugzilla.mozilla.org/show_bug.cgi?id=1878926>. I will apply a patch to the openSUSE packages if/when it becomes available there.