Mozilla Firefox before 41.0 does not properly restrict the availability of High Resolution Time API times which allows remote attackers to track last-level cache access and consequently obtain sensitive information via crafted JavaScript code that makes performance.now calls.