FROST Attack Tracks Apps and Sites via SSD Timing

Researchers at Graz University of Technology built FROST, an attack that uses only JavaScript and SSD timing to identify which sites and apps a user opens. It exploits the Origin Private File System in major browsers, requires no native code or permissions, and works on macOS and Linux. The attack will appear at DIMVA 2026.