Your SSD Is a Snitch. Every Website You Open Can Hear It.

A new browser-based side-channel called FROST profiles your apps and browsing by timing your storage drive. The browser vendors are calling it a feature, not a bug.

State of Surveillance Editorial Team

Blue padlock resting on a dark surface with a circuit board pattern, representing hardware-level security and side-channel attack surface
Photo via Unsplash

TL;DR: Researchers at Graz University of Technology just published details on FROST (Fingerprinting Remotely using OPFS-based SSD Timing). Any website you open can measure how your solid-state drive responds to other programs' reads and writes, and use that to figure out which apps and which other websites are running on your machine. The attack hits 89% accuracy on website identification and 96% on app detection. It works in Chrome, Firefox, and Safari. It needs no permissions. And right now, none of the browser vendors are planning to fix it. They're calling it a spec-compliant use of a standard web API.

What FROST Actually Is

On May 28, 2026, a research team at Graz University of Technology (with co-authors from Liebherr-Transportation Systems) published FROST, a side-channel attack that runs entirely inside a normal browser tab.[1][2]

Side-channel attacks aren't new. They squeeze secrets out of indirect signals: power draw, electromagnetic leaks, even the sound a keyboard makes. FROST does the same thing with your SSD's timing.

The trick is a relatively new browser feature called the Origin Private File System API (OPFS). OPFS is a web standard that lets a website store and read files in a private sandbox that's faster than the normal browser storage. Google built it for things like in-browser photo editors and offline apps.

Here's the problem. When your SSD is busy serving another program (say, Slack writing chat logs, or Chrome loading another tab, or your password manager reading from disk) the timing of your OPFS file operations changes. FROST measures that timing. Then a neural network classifier figures out what you must have been doing based on the timing pattern.[3]

No permissions. No JavaScript hack. No phishing. Just a website sitting in a background tab, listening to your drive.

The Numbers Are Bad

The research team tested FROST against real-world workloads. The results:[1][2][3]

  • 89% accuracy identifying which website is open in another tab
  • 96% accuracy detecting which native application is running on the machine
  • 662 bits per second data extraction rate on Linux
  • 892 bits per second data extraction rate on macOS
  • Works against Chrome, Firefox, and Safari. Chromium, Gecko, and WebKit all expose the OPFS API

That's not theoretical accuracy. A site that uses FROST can tell with high confidence that you have, say, Signal desktop open while you visit their page. Or that you're running 1Password. Or that you have a specific competitor's web app loaded in another tab.

For advertising networks, this is a fingerprinting goldmine. For stalkerware sites, it's a way to confirm what apps their target is using without ever needing a permission popup. For intelligence services running watering-hole attacks, it's free reconnaissance.

How the Attack Works (The Short Version)

OPFS is supposed to be a private storage area. But it's still backed by the same physical SSD that everything else on your computer is using. So when the SSD is busy, OPFS operations take longer. When it's idle, they're fast.

FROST exploits that by doing three things in a loop:[2][3]

  1. Write a small file to OPFS and time the operation
  2. Read the file back and time that too
  3. Look for patterns in the timing that match known application behaviors

The "patterns" part is where the neural network comes in. The researchers trained a model on SSD timing signatures for dozens of common apps and websites. Once trained, the model can recognize those apps and sites from new timing samples in real time.

It's the same fundamental trick as acoustic keyboard sniffing or power-analysis attacks on smart cards, just aimed at a drive instead of a microphone or a power line.

Why No Browser Vendor Is Going to Patch This

Here's the part that should make you angry.

The Graz team disclosed FROST responsibly. They told Google, Mozilla, and Apple before going public. All three responded, and all three said roughly the same thing: this is a working-as-intended use of a web standard.[1][2]

OPFS was designed to give web apps fast, private storage. Using it to measure SSD timing isn't a security bug in the OPFS spec. It's an unintended side effect of OPFS sharing a physical drive with everything else. There's no clean fix that wouldn't break legitimate OPFS apps, and the browser vendors aren't going to break a working web standard to plug a side channel that affects "only" fingerprinting.

Sound familiar? It's the same playbook as the FARSIGHT drone gait-recognition research, the canvas fingerprinting mess, and the long history of audio-context fingerprinting. When the web platform builds a powerful feature, advertisers and surveillance operators find a way to use it for tracking. The platform owners shrug.

The Graz team is presenting FROST at the DIMVA conference in July 2026. That gives browser vendors roughly a month to change their minds. The betting line is they won't.[3]

What This Means for You

FROST isn't a hack you can patch with a software update. It exploits the physical reality that your SSD has to be shared between programs. There is no browser setting that turns it off. There is no extension that blocks it. There is no "disable" toggle.

What you can do:

  • Use Tor Browser for sensitive browsing. The Tor Browser bundle ships with OPFS disabled by default. If you're doing anything that requires a high threat model (journalism, activism, security research) this is the practical workaround.
  • Keep sensitive apps in a separate browser profile or container. Firefox Multi-Account Containers and Chrome profiles don't help directly with FROST, but using a different browser entirely for sensitive apps does. If you keep Signal Desktop and 1Password on a machine you never open a normal browser on, FROST can't see them.
  • Run untrusted browsing in a VM. A virtual machine with its own virtual SSD is invisible to FROST on the host. Heavy-handed, but effective.
  • Disable OPFS in your browser flags (Chrome: chrome://flags/#file-system-access-api → Disabled; Firefox: about:config → dom.fs.enabled → false; Safari: Develop menu → Experimental Features → uncheck "OPFS"). You'll break some web apps, but you'll also close the side channel.
  • Be skeptical of "anonymous" browsing claims. Any vendor telling you their site tracks nothing about you is either lying or hasn't kept up with research published in the last month.

The Bigger Pattern

FROST is the latest in a string of "the web platform is a surveillance platform" discoveries. The pattern is always the same: a new browser feature ships for legitimate reasons, security researchers find a way to abuse it, browser vendors say it's working as designed, and the surveillance industry quietly adds it to the tracking stack.

Canvas fingerprinting. Audio context fingerprinting. Battery status API. WebGL renderer leaks. CPU concurrency probing. And now OPFS timing.

Each one is "not a vulnerability." Each one ends up in the fingerprinting arms race anyway. The web platform is a public good, and advertisers and intelligence agencies get to use it for free.

Until the browser vendors decide that side-channel fingerprinting is a CVE-worthy problem and not a "research result," expect more of these. FROST won't be the last. It's just the one that listens to your hard drive.

References

  1. Lekander, A. "New FROST attack leverages SSD side-channel to reveal browsing activity." CyberInsider, May 29, 2026.
  2. Liu, J. "Researchers say they can spy on your browsing by measuring SSD activity through a browser API." Tom's Hardware, May 28, 2026.
  3. Help Net Security. "Websites can spy on user activity by analyzing SSD behavior." May 29, 2026.
  4. Williams, A. "Websites are using this FROST-y new technique to spy on users by snooping on their SSD activity." TechRadar, May 28, 2026.