Open one web page and it can start guessing what else you're doing on your computer. Which sites you're loading. Which apps you're opening. No hacking, no popup asking for permission. You just have to load the page. It watches how busy your drive is and reads the clues.
That's the idea behind a new attack called FROST, short for Fingerprinting Remotely using OPFS-based SSD Timing. A team of security researchers laid it out in a research paper set to be presented at the DIMVA security conference in July.
How it actually works
Your SSD can only do so many things at once. When two programs hit it at the same moment, they fight over it, and each one slows down a tiny bit. FROST measures that slowdown. Its attack page keeps reading from one giant file on your drive and times every single read. When you open a new tab or load a heavy site, that burst of activity bogs down the drive for a split second, and the attacker's page catches the exact moment it happened.
To pull this off, the page needs a huge file sitting on your SSD. It grabs one through OPFS (the Origin Private File System), a browser feature that lets any site quietly store files on your disk without asking. Chrome and Safari let one site claim up to 60% of your drive this way, over 150GB on a 256GB SSD. The file has to be bigger than your RAM, otherwise reads come from memory.
Weissteiner et al, Ars Technica Websites Have New Way Spy Visitors
Where it gets creepy
Raw timing numbers don't mean much on their own. So the researchers fed them to a trained neural network. The sites and apps they tested each left their own rhythm of disk reads and writes.
And the payoff? It can match that rhythm back to a specific website or app, but only one it was trained on first. In a lab test where it only had to pick from a fixed list of 50 popular sites, it scored about 89%, and about 96% on a short list of apps.
Here's the wild bit. This works across totally different browsers. Researchers ran the attack page in Chrome while the victim browsed in Safari, and it still worked. All the fighting happens down at the hardware level, not inside any one browser's sandbox. Creepy, right?
Weissteiner et al, Tom's Hardware Researchers Say They Can Spy Your
How worried should you be
Not very. At least not yet. FROST has real limits, and that giant hidden file is the big one. It has to be bigger than your RAM, sit on the same physical SSD as the target activity, and hide well enough that you do not notice many gigabytes missing.
Plus the full attack was only proven on one machine, an M2 Mac Mini. Windows wasn't tested at all. There's no sign anyone has run FROST in the real world. It's a proof of concept.
Why a quick fix is unlikely
They floated two obvious fixes. Cap OPFS files so they cannot beat your RAM, or make sites ask before grabbing that much space. Simple stuff. The catch? Google's Chromium team doesn't count fingerprinting as a security bug, so a Chrome fix probably isn't coming soon. Apple said it might add a mitigation.
For now, the best defense is dumb and free. Close tabs when you're done with them. An attack like this mostly watches what's actively running, so a quiet machine hands it far less to read. Beyond that, you're stuck waiting on browser makers to care. Don't hold your breath.
