MediaResourceLoader loads media resources (e.g. HLS playlists and their segment/sub-resources) for a <video>/<audio> element. Whether a response is treated as an opaque cross-origin resource – which prevents script from observing its data and detailed timing – is controlled by loaderOptions.loadedFromOpaqueSource.

Pre-patch, cross-origin media sub-resources fetched after the main resource were not consistently marked opaque, so a cross-origin media stream loaded without CORS could leak data/timing (for example via Resource Timing entries or otherwise observable response state), i.e. cross-origin information disclosure.

The fix adds tracking of whether the main resource has loaded (m_wasMainResourceLoaded) and, in requestResource, marks a request opaque when it is cross-origin and uncredentialed by CORS: if (!m_document->securityOrigin().isSameOriginAs(SecurityOrigin::create(request.url())) && m_crossOriginMode.isNull() && m_wasMainResourceLoaded) loaderOptions.loadedFromOpaqueSource = Yes; else if (!m_wasMainResourceLoaded) m_wasMainResourceLoaded = true;. In other words, the first (main) resource load flips the flag, and subsequent cross-origin, non-CORS sub-resource loads are forced to opaque so their contents/timing are not exposed.

The restored invariant is that cross-origin media sub-resources without CORS are treated as opaque, closing the cross-origin data/timing leak.

The added tests cover cross-origin media resource-timing with and without CORS.

A cross-origin information-disclosure bug: cross-origin, non-CORS media sub-resources were not marked opaque, exposing their data/timing to script. It is a same-origin-policy leak with no memory-safety component, in the WebContent process. Rated medium.