New FROST Attack Lets Websites Track What Sites and Apps You Open via SSD Timing

FROST is a browser-only SSD timing side-channel that abuses OPFS to force disk reads from a large attacker-owned file and measures contention via high-resolution timers in JavaScript to fingerprint visited websites and native apps; Graz University researchers demonstrate high classification accuracy on macOS and a covert channel for data transfer, note no evidence of in-the-wild use, and recommend mitigations such as capping OPFS size, throttling timers, or adding permissions.