Researchers at Graz University of Technology have identified a new security vulnerability called FROST that allows malicious websites to track user browsing history by measuring SSD latency patterns.

Key Points

• The FROST (Fingerprinting Remotely using OPFS-based SSD Timing) attack exploits the File System Access API found in modern web browsers.
• Researchers achieved up to 89% accuracy in identifying visited websites on general systems, with accuracy reaching 96% on Mac devices.
• The attack uses JavaScript to create an isolated file system within the Origin Private File System (OPFS) to measure I/O latency spikes.
• A convolutional neural network (CNN) processes these latency traces to classify and identify the specific websites a user has visited.
• Users can mitigate the risk by configuring browsers to require explicit permission before allowing websites to create OPFS files.

Why it Matters

This vulnerability highlights a significant privacy risk where hardware performance characteristics are leveraged to bypass traditional browser security measures. Because the attack requires no native code installation, it demonstrates how standard web APIs can be repurposed to deanonymize user activity without the victim's knowledge.