FROST: The SSD Side-Channel Attack That Watches Everything You Do — Through Your Browser
A new technique called FROST exploits a legitimate browser storage API to fingerprint your visited websites and running apps with alarming accuracy — no permissions, no plugins, no warning.
Written by OutOfToken AI
June 7, 2026 · 4 min read · Synthesized from reporting by Tom's Hardware · How this works
Security researchers have demonstrated a novel browser-based side-channel attack that can identify which websites you're visiting and which applications you're running — simply by measuring how long your SSD takes to respond to file operations. Dubbed FROST, short for Fingerprinting Remotely using OPFS-based SSD Timing, the technique requires zero user interaction, zero browser permissions, and leaves no obvious trace. On a test Mac, it identified visited websites with roughly 89% accuracy and active applications with roughly 96% accuracy.
The Weapon: A Legitimate Browser API
FROST's attack surface is the Origin Private File System, a browser API originally designed to give web applications fast, sandboxed access to local storage — think complex productivity tools or games that need to read and write files without going through traditional file-picker dialogs. The API is supported across all major browsers and is considered a standard part of the modern web platform. Researchers found that by using JavaScript to create large files through OPFS and then carefully timing how long those read and write operations take, a malicious site can detect characteristic latency fluctuations in the SSD caused by competing I/O workloads happening elsewhere on the device.
How SSD Latency Becomes a Spy
The underlying physics here are well understood in side-channel research circles. SSDs are not passive storage; they actively manage wear leveling, garbage collection, caching layers, and queue depths. When another application or browser tab is hammering the drive with its own read/write operations, the latency profile of OPFS file operations shifts in measurable ways. FROST builds a timing fingerprint library — essentially a database of latency signatures corresponding to specific websites loading or specific applications running — then compares live measurements from a target user's device against that library. The statistical correlation does the rest. No kernel access, no elevated privileges, no OS-level hooks required.
""FROST identified active applications with roughly 96% accuracy and visited websites with roughly 89% accuracy on test hardware — using nothing but JavaScript and a standard browser API.""
Mitigations Are Complicated — and Inconsistent
The uncomfortable reality is that patching FROST cleanly is not straightforward. Browser vendors could artificially add noise or jitter to OPFS timing responses — a technique used to blunt previous side-channel attacks like Spectre-related timer exploits — but doing so degrades the performance benefits that make OPFS useful in the first place. Restricting OPFS entirely would break legitimate applications. Browser implementation details vary significantly across Chrome, Firefox, and Safari, meaning the attack's effectiveness and any mitigations will be uneven across platforms. Researchers presented the work at a security conference, and the underlying methodology has been validated as technically sound, but real-world exploitability depends heavily on how quickly browser makers respond and how much the fingerprint library can generalise across diverse hardware configurations.
FROST is a reminder that the modern browser has quietly become one of the most powerful sensing platforms on any device — and that APIs designed for developer convenience can be weaponised in ways their architects never anticipated. As browser vendors absorb the research and weigh performance trade-offs against privacy obligations, users have few practical defenses beyond keeping browsers updated and watching for OPFS-specific mitigations to land in future releases. The attack is not yet confirmed in the wild, but the bar for deployment is low enough that it almost certainly will be.
Editorial Note
FROST is a documented side-channel attack researched by legitimate security researchers that exploits timing differences in Origin Private File System (OPFS) operations to infer user browsing behavior. The attack methodology has been publicly presented at security conferences and the underlying technical principles (measuring SSD access latency patterns) are sound and consistent with known side-channel attack vectors. However, the practical exploitability and real-world impact remain subject to browser implementation details and mitigation measures that evolve over time.
Claim Tracker
AI-assessed
Specific to test conditions; generalization to other systems not established in excerpt
Broad claim requiring full research paper verification; 'no obvious trace' is subjective
OPFS (Origin Private File System) is indeed implemented in Chrome, Firefox, Safari, and Edge
Accurate description of OPFS design intent per W3C specifications
Core mechanism claim; validity depends on research methodology not detailed in excerpt
Ask AI about this story
// discussion
sign in to join the discussion