06/03/2026
FROST: A New Browser-Based Technique Raises Serious Privacy Concerns
Cybersecurity researchers have identified a new tracking technique called FROST (Fingerprinting Remotely Using OPFS-Based SSD Timing) that could significantly expand how websites monitor user activity. Unlike traditional tracking methods that rely on cookies, browser fingerprints, or behavioral analysis, FROST exploits subtle timing variations in a device's solid-state drive (SSD) activity to infer information about what a user is doing.
The technique leverages a type of side-channel attack known as a contention side channel. Rather than directly accessing sensitive information, attackers measure indirect signals generated when multiple processes compete for shared hardware resources. In this case, JavaScript running inside a browser can observe storage timing patterns associated with SSD operations. Those patterns may reveal information about other browser tabs, websites, or applications running on the device.
What makes FROST particularly concerning is that it operates through standard browser functionality rather than requiring malware or elevated system privileges. Researchers demonstrated that carefully crafted web pages can gather information about system activity simply by measuring tiny variations in storage access performance. While the technique does not expose files or directly steal data, it can potentially create a new form of device fingerprinting and behavioral surveillance.
The discovery highlights an ongoing challenge in cybersecurity: as traditional tracking methods become more restricted through browser privacy protections, researchers and adversaries continue discovering new side channels that can leak information. Similar techniques have historically exploited CPU caches, memory access patterns, network timing, power consumption, and electromagnetic emissions.
Key Takeaways: FROST is a newly disclosed browser-based side-channel technique that uses SSD timing measurements to infer information about device activity. The method relies on standard browser capabilities and does not require malware installation. While it does not directly access private files, it could enable mor
