UserAgent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/53.0.2785.143 Chrome/53.0.2785.143 Safari/537.36

Steps to reproduce the problem:
1. Go to http://example.com/ 
2. Open Console, register a protocol handler:

  navigator.registerProtocolHandler("web+grr", "http://example.com/%s?%s", "NB: two %s");

   and click "Allow".
3. Enter "web+grr:substitute" in the address bar.

What is the expected behavior?
Browser should load

  http://example.com/web%2Bgrr%3Asubstitute?%s

replacing only the first %s in the template with the encoded URL.

What went wrong?
Browser loads

  http://example.com/web%2Bgrr%3Asubstitute?web%2Bgrr%3Asubstitute

replacing all %s in the template.

Did this work before? N/A 

Does this work in other browsers? Yes

Chrome version: 53.0.2785.143  Channel: stable
OS Version: 
Flash Version: 

"When the user agent uses this handler, it must replace the *first* occurrence of the exact literal string "%s" in the url argument..." 

https://html.spec.whatwg.org/multipage/webappapis.html#dom-navigator-registerprotocolhandler