Researchers say they can spy on your browsing by measuring SSD activity through a browser API

Researchers from Graz University of Technology in Austria have unveiled a novel side-channel attack called FROST, which can monitor user browsing behavior by leveraging browser APIs. The technique exp... Read original →

The FROST attack exposes a critical failure in isolating storage layers from execution environments in modern browsers. Origin Private File System (OPFS), designed for performance, inadvertently enables side-channel leakage via SSD read-latency patterns due to lack of timing noise injection. This forces NAND controller vendors to embed randomized latency mechanisms in firmware—increasing SSD design complexity and BOM costs. Under GDPR and China’s PIPL, such passive profiling constitutes unauthorized behavioral tracking, exposing firms to multi-million-dollar penalties. Apple and Google will likely throttle OPFS granularity at the cost of PWA performance, while Microsoft may leverage Edge’s hardened sandbox as a differentiator. Within 18 months, co-designed browser-storage security architectures will emerge, catalyzing a 'privacy-aware SSD' segment—prompting NAND suppliers in Taiwan, China and South Korea to integrate firmware-level countermeasures ahead of regulatory mandates.