May 28, 2026
Researchers Publish Method to Surveil Web Page Visitors by Analyzing Their SSD Activity · Daring Fireball
Science, Technology & Innovation · May 28, 2026
Research-stage disclosure (no observed deployment) shows JavaScript access to OPFS plus timing-sensitive SSD reads and machine learning can infer host activity, creating an architectural browser privacy risk best addressed proactively via API/quota changes, storage restrictions, and privacy/hardening measures.
Researchers Publish Method to Surveil Web Page Visitors by Analyzing Their SSD Activity · Daring Fireball
Science, Technology & Innovation · May 28, 2026
FROST is hard to scale stealthily because it requires extremely large (≈1+ GB) OPFS files colocated on the victim’s SSD, so defenders can mitigate it by closing tabs, monitoring or capping OPFS file creation/size, and using storage-quota policy as a security control.
Researchers Publish Method to Surveil Web Page Visitors by Analyzing Their SSD Activity · Daring Fireball
Science, Technology & Innovation · May 28, 2026
Researchers demonstrate that attacker-controlled JavaScript can abuse the browser's Origin Private File System (OPFS) by creating large files, performing repeated random reads, and measuring read latency—then using a CNN to infer which apps or websites are running on the same machine—showing sandboxing alone can't prevent leakage via shared SSD I/O timing.
Researchers Publish Method to Surveil Web Page Visitors by Analyzing Their SSD Activity · Daring Fireball
Science, Technology & Innovation · May 28, 2026
Evidence for the SSD‑access JavaScript side‑channel attack is strongest on Apple silicon macOS (complete end‑to‑end on an M2 Mac), partially validated on Linux (measurement primitive only), and untested on Windows—cross‑platform risk is plausible given similar JS SSD‑latency signals, but remediation urgency should be weighted toward macOS until broader validation.