Websites have a new way to spy on visitors: Analyzing their SSD activity

Websites are now using a new technique called FROST to spy on visitors by analyzing their solid-state drive (SSD) activity, allowing them to monitor other sites the visitor is viewing and open apps on their devices. This technique exploits a side channel, measuring the timing of I/O operations on the SSD to determine open websites and apps without any interaction needed from the visitor. FROST operates exclusively in the browser using JavaScript to interact with the OPFS, a storage space allocated for a specific site. This method highlights the increasing attack surface of web browsers due to their evolution into complex platforms capable of running sophisticated applications.