When a Response is stored via the Cache API, Firefox pads the recorded body size to hide the true length of opaque cross-origin resources, but the padding was too coarse and too small: InternalResponse.cpp drew a random pad of at most kMaxRandomNumber (102400) bytes and FileUtils.cpp rounded up to multiples of kRoundUpNumber (20480) bytes. Because these padding windows were narrow relative to real resource sizes, the padded/rounded size still correlated closely with the underlying resource’s actual length, violating the invariant that a cached opaque response must not leak its true size to the storing origin. An attacker could observe the padded size (for example via quota/storage accounting) and, across many cached responses, recover length information about cross-origin resources they are not entitled to read.

The fix widens both windows — raising kMaxRandomNumber to 1048576 and kRoundUpNumber to 131072 — so the padding-induced uncertainty is large enough to mask the real size and break the side channel. This works because the observable stored size now falls into much larger, coarser buckets that many distinct resource lengths map onto, reducing the information leaked per observation.

An attacker running script in a content process gains a side channel that leaks the approximate byte length of opaque cross-origin resources they cannot otherwise read, enabling cross-site information disclosure. Exploitation requires the ability to cause the target resources to be fetched and stored in the Cache API and to observe storage size accounting, with accuracy improving over repeated observations. Impact is rated moderate: it discloses size-derived information rather than granting memory corruption or direct content read.