Websites Can Now Spy on You Through Your Hard Drive
Researchers showed a browser-based attack that can infer open tabs and apps by measuring SSD timing through OPFS.
Intelligence analysis by GPT-5.4 Mini
A new browser attack called FROST uses timing differences from SSD activity to learn what websites and apps are open. It runs in JavaScript, needs no user interaction, and has not been seen in the wild.
A website found a sneaky way to listen for tiny noises made by a computer’s hard drive-like storage. It is a bit like guessing what someone is cooking by hearing pots and pans clink in the kitchen next door.
The trick does not read files directly. Instead, it watches how long storage actions take, and those delays can hint at what other apps or web pages are open.
The good news is that the idea is still a research result, not something seen widely in the wild. Closing extra tabs and stopping strange sites from making huge storage files can help reduce the risk.
Analysis
What the attack does
Researchers described FROST, short for fingerprinting remotely using OPFS-based SSD timing, as a browser-only side channel that can infer what a person is doing on their device. By hosting JavaScript that repeatedly reads from a large file in the browser’s origin private file system, the attacker can watch for tiny latency changes caused by other activity on the same solid-state drive.
Those timing shifts become a signal. The paper says a pretrained convolutional neural network can classify the traces and infer open websites, including tabs in other browsers, and in some cases detect apps running on the device. The article emphasizes that no visitor interaction is needed beyond loading the malicious page.
Limits and defenses
The technique is not frictionless for attackers. It needs a very large OPFS file, likely around a gigabyte or more, which may make large-scale abuse easier to notice. It also works best when the target activity shares the same SSD; if apps are on a different drive, they may not show up.
The story says the researchers ran the full attack on an M2 Mac. On Linux, they demonstrated the underlying primitive but not the full end-to-end attack; they said similar performance could likely support the full classification. Windows was not tested.
The article notes there are no signs FROST has been used in the wild. Still, the paper suggests browser makers could reduce risk by limiting the maximum size of files allowed in this storage area. For users, the practical advice is simple: close tabs when they are no longer needed and watch for unknown sites creating large OPFS files.
Key points
- Researchers described FROST, a browser-based side channel that uses SSD timing to infer user activity.
- The attack can reveal open websites and sometimes apps by measuring latency in OPFS reads.
- It requires no interaction beyond visiting the malicious site, but it needs a very large file and is easier to notice at scale.
- The paper has not been reported in the wild, and the researchers ran the full attack on an M2 Mac.
