Malicious Websites Exploit SSD Timing Signals to Monitor Visitor Activity

Gbhackers •Divya • May 28, 2026

Malicious websites can now exploit subtle SSD timing signals in modern browsers to quietly track what users are doing on their devices, including which sites and apps they open, using a new side‑channel technique called FROST. Security researchers Hannesweissteiner have revealed that a single drive‑by visit to a booby‑trapped page is enough for an attacker […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New FROST Attack Reveals SSD Activity, Compromising User Privacy Researchers at Graz University of Technology have unveiled a side-channel attack named FROST, which allows malicious websites to monitor users' SSD activity and identify open websites and applications with up to 89% accuracy. This attack exploits the Origin Private File System (OPFS) through JavaScript, requiring no special permissions or user interaction beyond visiting an infected site. The method measures SSD access latency to infer user activity, functioning across different browsers. Major tech companies, including Google and Apple, have been informed, but responses vary, with Google not classifying it as a vulnerability. The attack primarily affects users on Mac systems, with limited testing on Linux and no testing on Windows. The significant file size requirement for the attack poses a practical barrier, as users would likely notice large storage consumption. Recommendations include limiting OPFS file sizes or requiring user consent for file creation. 7 sources 62

Extracted Entities

MITRE ATT&CK (1)

T1189 - Drive-by Compromise