FROST attack uses browser API to spy on browsing activity via SSD timing measurements, researchers find

Summary

Security researchers at Graz University of Technology have published a paper describing FROST (Fingerprinting Remotely using OPFS-based SSD Timing), a side-channel attack that exploits the browser's Origin Private File System (OPFS) API to measure SSD access latency via JavaScript. This allows a malicious website to identify what other sites and apps a visitor has open with 89% accuracy for websites and 96% for applications, requiring no special permissions or user interaction beyond visiting the malicious site. The attack works within a standard browser sandbox and represents a novel privacy vulnerability in modern browsers.