FROST: the attack that transforms the browser into a spy by measuring the latency of SSD to reveal your sites and your apps

A new attack baptized as FROST, described by researchers from the University of Graz Technology and presented in DIMVA 2026, shows that a malicious website may know which sites you visit and which applications open by simply measuring the latency of an SSD from JavaScript. The novelty is not that SSD disks filter information - that family of errors already included research like Secret Spying Drive - but that FROST eliminates the need for native code or explicit permissions: everything runs in the browser sandbox and takes advantage of a standardized API called Origin Private File System (OPFS), designed for web applications to manage local files without asking the user for permission.

The technical vector is simple and worrying in its effectiveness. OPFS allows each web source to book and write files in a portion of the disk without user interaction. An attacker creates a larger file than the RAM of the team to force direct readings to the SSD instead of hits on the cache, and then runs random readings of 4 KB blocks by measuring time with high resolution watches. When another site is loaded or an app starts, the disc containment alters those times and a trained classifier can identify with high precision which software or page generated the disturbance. In the experiments reported, the inference against the 50 most popular websites reached F1 scores close to 89% in macOS and was even more effective in identifying native applications; in addition, researchers mounted a covert channel capable of transferring hundreds of bits per second between a cooperating native app and the malicious page.

While the technique is based on a physical time channel - something that the security community has known for years - the transformation from a local attack to a remote one is what alters the picture: it is enough for a user to visit or leave open a tab for the site to observe the activity on your computer. This changes the risk, especially in single disk equipment, where everything lies in the same unit; machines with multiple disks or configurations that maintain the browser profile in RAM (for example, certain deployments with prophyle-sync-daemon in Linux) limit the surface, but these are not universal solutions.

The practical mitigation options for a user today are limited but useful. Close suspicious tabs immediately stop the measurement, and monitor browser storage to detect extraordinarily large files linked to unknown origins is an indication of commitment. Disable JavaScript for unreliable sites or using scripts lock extensions will reduce exposure as well as using configured browsers with separate profiles or running sensitive activity on virtual machines or a dedicated browser only for critical tasks. For administrators, isolate processes on different disks or use policies that prevent the profile from being written on disk can be an effective defense as patches arrive.

The definitive corrections, however, depend on browser manufacturers. Among the possible technical solutions are limit the maximum size OPFS can reserve by source to fit in cache, add a permit table for the intensive use of local storage, or degrade the temporary resolution when OPFS is in use. Each alternative has a cost in usability or performance, so suppliers have to weigh the impact: Google, Apple and Mozilla were warned before the publication and so far there has been no uniform action or public CVE that brings the issue together.

From a broader perspective, FROST highlights a trend: the browser continues to expand the native capabilities it offers to web applications, and with them the low-level information escape routes grow. This is not only an isolated vulnerability but a design lesson: the APIs that give close access to hardware require privacy assessments and side channel risks as rigorous as those applied to traditional security interfaces. Meanwhile, users and organizations should assume that leaving open tabs with implicit confidence implies a risk and adopt defenses that reduce exposure until browsers implement mitigation.

For those who want to deepen the technology concerned, the WICG OPFS specification describes why the API was designed without permit dialogues: Origin Private File System (WICG). The conference where the work is presented and the academic context of the area can be found on the DIMVA page: DIMVA. It is also useful to review how native E / S interfaces such as io _ uring influenced previous research on disk filtering: io _ uring - Linux kernel documentation.