Back to feed

Researchers Publish Method to Surveil Web Page Visitors by Analyzing Their SSD Activity

Daring Fireball

May 28, 2026

5/28/2026

Research Stage Disclosure Highlights Browser Side Channel Risk From JavaScript Access To OPFS And Timing-Sensitive SSD Reads For Early Preventive Web API Governance

Researchers Publish Method to Surveil Web Page Visitors by Analyzing Their SSD Activity · Daring Fireball

Science, Technology & Innovation · May 28, 2026

Research-stage disclosure (no observed deployment) shows JavaScript access to OPFS plus timing-sensitive SSD reads and machine learning can infer host activity, creating an architectural browser privacy risk best addressed proactively via API/quota changes, storage restrictions, and privacy/hardening measures.


5/28/2026

FROST Side Channel Requires Large On-Disk OPFS On Same SSD Limiting Deployment And Enabling Mitigations Through Quotas And Monitoring

Researchers Publish Method to Surveil Web Page Visitors by Analyzing Their SSD Activity · Daring Fireball

Science, Technology & Innovation · May 28, 2026

FROST is hard to scale stealthily because it requires extremely large (≈1+ GB) OPFS files colocated on the victim’s SSD, so defenders can mitigate it by closing tabs, monitoring or capping OPFS file creation/size, and using storage-quota policy as a security control.


5/28/2026

Web Pages Infer Host Activity From Origin Private File System Timing

Researchers Publish Method to Surveil Web Page Visitors by Analyzing Their SSD Activity · Daring Fireball

Science, Technology & Innovation · May 28, 2026

Researchers demonstrate that attacker-controlled JavaScript can abuse the browser's Origin Private File System (OPFS) by creating large files, performing repeated random reads, and measuring read latency—then using a CNN to infer which apps or websites are running on the same machine—showing sandboxing alone can't prevent leakage via shared SSD I/O timing.


5/28/2026

Cross-Platform Fingerprinting Attack Evidence Is Strongest On macOS With Linux Plausible And Windows Unverified

Researchers Publish Method to Surveil Web Page Visitors by Analyzing Their SSD Activity · Daring Fireball

Science, Technology & Innovation · May 28, 2026

Evidence for the SSD‑access JavaScript side‑channel attack is strongest on Apple silicon macOS (complete end‑to‑end on an M2 Mac), partially validated on Linux (measurement primitive only), and untested on Windows—cross‑platform risk is plausible given similar JS SSD‑latency signals, but remediation urgency should be weighted toward macOS until broader validation.