Researchers at Graz University of Technology this week detailed a browser-based attack that identifies which websites and applications a visitor has opened by measuring solid-state drive (SSD) activity, requiring no permissions, software installation, or user interaction.
The technique, named FROST, short for Fingerprinting Remotely using OPFS-based SSD Timing, exploits the Origin Private File System (OPFS) API, a storage interface built into Chrome, Firefox, and Safari.
FROST deposits a large OPFS file on the target’s SSD, sized to exceed available RAM, forcing reads past the operating system’s page cache to the physical drive. Competing I/O activity from other open applications creates measurable latency spikes that a convolutional neural network (CNN) classifies to identify active sites and applications.
The researchers reported 88.95% accuracy for website identification and 95.83% for running applications. The attack functions across browsers, producing a minimal performance difference when the attacker and victim use different browsers.
Researchers unveil the FROST SSD fingerprinting attack. Learn how malicious JavaScript reads OPFS storage latency to track open tabs and background apps.#FROST #CyberSecurity #HardwareSecurity #PrivacyAlert #Infosec2026 #BrowserFingerprintinghttps://t.co/okMHTDEPvy pic.twitter.com/nNmMIzhDVH
— Gray Hats (@the_yellow_fall) May 29, 2026
The capability carries direct implications for defense and intelligence personnel.
A state-sponsored or compromised website could silently determine whether a visitor is running encrypted communications applications, virtual private network (VPN) clients, or other operational security tools, undetected.
Chrome and Safari allow a website to claim up to 60% of disk space through OPFS, exceeding 150GB on a standard 256GB drive. Researchers proposed capping file sizes within available RAM or requiring user consent. Google does not classify fingerprinting as a security vulnerability, making near-term fixes unlikely.
“In principle, it would be possible to train a model on any system activity that reliably generates SSD accesses,” lead author Hannes Weissteiner wrote in an email to Ars Technica.
There are no confirmed reports of FROST being used in active operations, and full attack verification has been completed only on macOS.
The research is scheduled for presentation at the DIMVA conference in July 2026.
