A research team from Austria has unveiled a novel form of browser side-channel attack, dubbed FROST. This attack capitalizes on the timing patterns of Solid State Drives (SSDs) during data request processing. By leveraging nuanced signals emanating from web page code and the storage hardware of the device, it can deduce the other websites a user has visited, all without necessitating any further interaction from the user. The attack is executed by generating sizable OPFS (Origin-Private File System) files and logging the read latencies, subsequently categorizing these latency patterns with the aid of a convolutional neural network.
However, it's important to note that this attack method necessitates the use of large files and is confined to operations on the same SSD. Moreover, it has not yet been deployed in real-world scenarios. The research advises that browser developers should impose restrictions on the size of OPFS files, and users are encouraged to promptly close any tabs that are not in use.
