A new browser-based attack named FROST (fingerprinting remotely using OPFS-based SSD timing) demonstrates how JavaScript can infer which websites and applications a user has open by measuring contention on their solid-state drive. The technique, detailed in a forthcoming paper from academic researchers, exploits a timing side channel in the browser's Origin Private File System (OPFS).

Modern browsers support OPFS as a sandboxed storage allocation per origin, intended for running complex applications like IDEs or office suites. FROST creates a large OPFS file (1GB or more) and performs random reads while monitoring latency variations. When other processes—such as a different browser tab or a native app—issue I/O operations to the same SSD, the read latency shifts measurably. A pretrained convolutional neural network classifies these timing patterns to identify specific user activity.

Key architectural constraints: the OPFS file must reside on the same SSD as the target data, and the file size requirement makes large-scale attacks detectable. The attack works entirely within the browser without user interaction beyond visiting the malicious site. Testing was performed on macOS (M2) and Linux, with Windows untested. Mitigations include limiting OPFS maximum file size at the browser level or monitoring OPFS allocations.

From an engineering perspective, this is a classic resource contention side channel, similar to cache-timing attacks, but now weaponized through a high-level browser API. The practical risk is currently low due to the storage overhead and lack of in-the-wild deployment. However, it highlights a fundamental tension: as browsers expose low-level storage primitives for legitimate applications, they inadvertently increase the attack surface for timing-based inference.

Source: Wired