So any sufficiently motivated/funded malicious actor who can register a whole bundle of domains can use up 50% of the entire free space on my disk? Am I getting this right?

Is the only defense against this the requirement for per-origin permission to be granted?

> The OPFS is subject to browser quota restrictions.

FWIW, 256mb last i checked (summer 2022). Perhaps less on mobile browsers, but that's just speculation.

Which means nothing unless the defaults are restrictive.

What are the default browser quota restrictions on install?

I run desktop (not mobile) Firefox with an in-memory cache only. My opinion is that on-disk cache with several days (or weeks) old content is almost entirely useless, and that the most beneficial cache use is what you fetch/reuse through a single day of running browser.

Here's how you can "make the switch":

First of all, clear your disk cache entirely. Then, head into "about:config" and change accordingly:

  browser.cache.disk.enable -> false
  browser.cache.disk.smart_size.enabled -> false
  browser.cache.disk_cache_ssl -> false
  browser.cache.offline.enable -> false
  browser.cache.memory.enable -> true
  browser.cache.memory.capacity -> 512000
  browser.privatebrowsing.forceMediaMemoryCache -> true

The number 512000 is in kilobytes. Adjust to preference. Firefox will still do some caching to disk, but these settings stop the most pressing disk writes. You may confirm the change by visiting "about:cache".

“Several gigabytes” for a browser cache is not abnormal, nor “swamping the disk”. Welcome to the web.