Researchers Uncover Websites Spying on Hard Drives via SSD Latency

A malicious website can now accurately determine what other sites a user has visited and applications they have open with up to 96% accuracy, simply by visiting their page. This capability stems from a newly discovered method, dubbed FROST, which allows websites to access data stored in a computer's solid state drive (SSD) without direct user interaction, according to Futurism. This allows for covert profiling of users by websites spying on hard drives in 2026.

Web browsers are designed to isolate individual websites within secure sandboxes. However, the FROST attack demonstrates these sandboxes can be exploited, inferring sensitive system-level user activity, as detailed by ZME Science. This challenges the fundamental promise of browser-based security.

Without architectural changes to browser security or SSD interaction, users face an escalating risk of covert surveillance from seemingly benign web interactions. Cybersecurity researchers developed FROST (Fingerprinting Remotely using OPFS-based SSD Timing) to spy on browser activity by measuring SSD load via an API, according to dev.ua. This method leverages standard JavaScript within a browser sandbox to measure SSD access latency, revealing other open sites and applications.

How Websites Access User Activity Data

• A machine learning model used with the FROST technique predicted accessed websites with an accuracy rate of 88.95 percent and accessed applications with 95.83 percent accuracy, according to Futurism.
• The FROST attack achieved an F1 score of 88.95% in identifying visits to the top 50 websites and 95.83% in identifying 10 built-in macOS apps, according to ZME Science.
• Security researchers developed FROST to identify visited websites with roughly 89% accuracy and running applications with roughly 96% accuracy on a test Mac by measuring SSD access latency through JavaScript, according to Tom's Hardware.
• FROST identified visited websites with about 89% accuracy and launched applications with about 96% accuracy on a test Mac, according to dev.ua.

The consistently high accuracy across multiple sources underscores FROST's potent capability to precisely profile user activity. This makes it a significant threat for targeted surveillance. The attack leverages standard web technologies to infer activity across the entire computer, challenging the isolation model browsers are built upon.