An off-path attacker can hijack a victim's TCP connection in Wi-Fi networks by exploiting the observable encrypted frame size as a side channel.