Websites have a new way to spy on visitors: analyzing their SSD activity
Researchers showed a browser-only attack that can infer open websites and apps by measuring SSD timing through OPFS.
Intelligence analysis by GPT-5.4 Mini
A new side-channel attack called FROST uses browser JavaScript and OPFS storage to detect subtle SSD timing differences. By feeding those traces into a trained CNN, researchers say a site can infer other tabs and apps on the device.
A website can sometimes learn sneaky things without asking for permission. In this case, it watches tiny delays from a computer’s storage drive, almost like hearing a faint bump in the pipes.
Those delays can hint at what else the computer is doing. It may be able to guess which other tabs are open or which apps are running, even though the site cannot directly see them.
It is a bit like feeling footsteps through the floor and guessing who is walking upstairs. The floor is the SSD, and the website is trying to read the rhythm.
Analysis
What FROST does
Researchers described a browser-based attack named FROST, short for fingerprinting remotely using OPFS-based SSD timing. The site hosting the attack does not need special permissions from the visitor; simply opening the page is enough to start measuring timing differences.
How it works
The attack uses JavaScript and the browser’s origin private file system, or OPFS, to create a large file and repeatedly perform random reads from it. When the visitor’s device is busy with other activity, those reads take slightly longer. The researchers say those latency changes reveal contention on the SSD, which can be used as a side channel.
The trace data is then analyzed with a pretrained convolutional neural network. According to the article, that model can classify the traces well enough to infer which websites are open in other tabs, even across different browsers, and which apps are open on the device.
Limits and defenses
The method is not trivial to deploy at scale. The OPFS file has to be very large, likely around a gigabyte or more, and it has to live on the same SSD used by the activity being monitored. That makes the attack easier to notice and limits what it can observe if apps are stored elsewhere.
The researchers suggest browser makers could reduce the risk by limiting the maximum size of these files. The article also notes that users can reduce exposure by closing tabs when they are no longer needed and watching for large OPFS allocations from unfamiliar sites. The paper is scheduled for presentation at DIMVA in July, and the researchers say they have no evidence the attack has been used in the wild.
Key points
- Researchers described FROST, a browser-only side-channel attack that measures SSD timing through OPFS.
- The attack can infer other open websites and some open apps by watching subtle latency changes.
- A pretrained convolutional neural network is used to classify the timing traces.
- The method has practical limits, including a very large OPFS file requirement and dependence on the same SSD.
- The paper says browser makers could blunt the attack by restricting file size, and there is no sign it has been used in the wild.
