how does a cookie (google.com NID) get set by visiting about:blank?

[Robert Riches]

In Firefox ESR 45.8.0, if I delete all cookies, close the
browser, and open the browser again to "about:blank", I see a
cookie for google.com named "NID" has been set. How does
starting the browser and viewing a non-internet-based pseudo-page
set that cookie?

My main concern is that some malware might have snuck into my
browser profile tree. I'm not running any extensions or plugins
from Google. My operating system is Debian Linux 7/Wheezy.

In case it might be related, for at least a few months I have
noticed on nearly a daily basis three rejected network packets
being logged with a destination IP address of 173.194.203.127 and
destination port 19302. Reverse DNS says that IP address is for
host pg-in-f127.1e100.net under the Google umbrella. (1e100 is
scientific notation for a Googol.) Port 19302 appears to be for
Google Talk Voice and Video connections. Of the three packets
sent (usually) in the same second, each is sent with a source IP
address corresponding to a different network interface. Only one
interface has by a default route. The second interface is a
hardware NIC that connects to some thin/zero-client machines.
The third interface is a KVM virtual bridge (virbr0) to talk with
any VMs I might be running. There is no valid reason the web
browser should be sending packets on either the second or third
interface.

Thanks.

--
Robert Riches
spamt...@jacob21819.net
(Yes, that is one of my email addresses.)