diff --git a/quic/core/http/http_encoder.cc b/quic/core/http/http_encoder.cc
index 5aeb44c..dfc7946 100644
--- a/quic/core/http/http_encoder.cc
+++ b/quic/core/http/http_encoder.cc
@@ -8,6 +8,7 @@
 
 #include "net/third_party/quiche/src/quic/core/crypto/quic_random.h"
 #include "net/third_party/quiche/src/quic/core/quic_data_writer.h"
+#include "net/third_party/quiche/src/quic/core/quic_types.h"
 #include "net/third_party/quiche/src/quic/platform/api/quic_flags.h"
 #include "net/third_party/quiche/src/quic/platform/api/quic_logging.h"
 
@@ -248,30 +249,42 @@
 // static
 QuicByteCount HttpEncoder::SerializeGreasingFrame(
     std::unique_ptr<char[]>* output) {
-  // To not congest the network, a greasing frame only contains a uint8_t as
-  // payload.
   uint64_t frame_type;
-  uint8_t frame_payload;
+  QuicByteCount payload_length;
+  std::string payload;
   if (!GetQuicFlag(FLAGS_quic_enable_http3_grease_randomness)) {
     frame_type = 0x40;
-    frame_payload = 20;
+    payload_length = 1;
+    payload = "a";
   } else {
     uint32_t result;
     QuicRandom::GetInstance()->RandBytes(&result, sizeof(result));
     frame_type = 0x1fULL * static_cast<uint64_t>(result) + 0x21ULL;
-    QuicRandom::GetInstance()->RandBytes(&frame_payload, sizeof(frame_payload));
+
+    // The payload length is random but within [0, 3];
+    payload_length = result % 4;
+
+    if (payload_length > 0) {
+      std::unique_ptr<char[]> buffer(new char[payload_length]);
+      QuicRandom::GetInstance()->RandBytes(buffer.get(), payload_length);
+      payload = std::string(buffer.get(), payload_length);
+    }
   }
-  QuicByteCount total_length =
-      QuicDataWriter::GetVarInt62Len(frame_type) +
-      QuicDataWriter::GetVarInt62Len(sizeof(frame_payload)) +
-      sizeof(frame_payload);
+  QuicByteCount total_length = QuicDataWriter::GetVarInt62Len(frame_type) +
+                               QuicDataWriter::GetVarInt62Len(payload_length) +
+                               payload_length;
 
   output->reset(new char[total_length]);
   QuicDataWriter writer(total_length, output->get());
 
-  if (writer.WriteVarInt62(frame_type) &&
-      writer.WriteVarInt62(sizeof(frame_payload)) &&
-      writer.WriteUInt8(frame_payload)) {
+  bool success =
+      writer.WriteVarInt62(frame_type) && writer.WriteVarInt62(payload_length);
+
+  if (payload_length > 0) {
+    success &= writer.WriteBytes(payload.data(), payload_length);
+  }
+
+  if (success) {
     return total_length;
   }
 
diff --git a/quic/core/http/quic_send_control_stream_test.cc b/quic/core/http/quic_send_control_stream_test.cc
index 66fcbcd..1bc10bf 100644
--- a/quic/core/http/quic_send_control_stream_test.cc
+++ b/quic/core/http/quic_send_control_stream_test.cc
@@ -124,8 +124,8 @@
       "4040"  // 0x40 as the reserved settings id
       "14"    // 20
       "4040"  // 0x40 as the reserved frame type
-      "01"    // 8 bytes for uint8_t
-      "14");  // 20
+      "01"    // 1 byte frame length
+      "61");  //  payload "a"
 
   auto buffer = std::make_unique<char[]>(expected_write_data.size());
   QuicDataWriter writer(expected_write_data.size(), buffer.get());