Loading story…
Researchers at Graz University of Technology disclosed FROST, a browser-based side-channel attack that uses JavaScript and the browser's Origin Private File System (OPFS) to infer what websites and applications are running on a victim device. The technique requires only that a target visit a malicious webpage; the page then creates a very large OPFS file—likely 1 GB or more—and performs random reads to measure SSD latency changes caused by storage contention from other activity. Using pretrained machine-learning models, the researchers showed the attack could identify visited websites with about 89% accuracy and running applications with about 96% accuracy on an Apple M2 Mac, and said the side channel works across browsers because it relies on the storage layer rather than browser-specific behavior.
The researchers said FROST removes the need for native code or privileged kernel access used in earlier SSD side-channel attacks, though it is constrained by practical requirements, including use of the same SSD for both OPFS storage and monitored activity. They validated the latency-measurement primitive on Linux, did not test Windows, and reported no evidence of exploitation in the wild. After disclosure to Google, Apple, and Mozilla, the vendors did not commit to major fixes; Google reportedly said fingerprinting is not treated as a security vulnerability. Proposed mitigations include limiting maximum OPFS file sizes, requiring explicit permission for OPFS file creation, monitoring suspicious large OPFS files, and closing unused browser tabs.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
The researchers disclosed the issue to Google, Apple, and Mozilla. According to the report, none committed to meaningful fixes, and Google said fingerprinting is not considered a security vulnerability.
In testing on Apple M2 systems, the researchers demonstrated the full attack and showed it could identify visited websites with about 89% accuracy and running applications with about 96% accuracy. They also validated the underlying latency-measurement primitive on Linux, while Windows was not tested.
Researchers described FROST, a JavaScript-based technique that uses the Origin Private File System to measure SSD contention and infer which websites and applications are active on a victim device. They reported no evidence of exploitation in the wild and said the attack works without permissions or user interaction beyond visiting a malicious webpage.
Following disclosure of the FROST browser-based SSD timing attack, Apple said it planned mitigations, while Mozilla acknowledged the issue but had not yet implemented protections. The same report said Google did not treat the technique as a vulnerability.
Researchers reported that FROST can identify device models with 88.95% accuracy and distinguish individual devices with 95.83% accuracy by measuring SSD timing through OPFS in the browser. They also demonstrated a covert channel using the same mechanism, reaching 661 bit/s on Linux and 892 bit/s on macOS.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
14 references tracked. Mallory keeps watching after this page renders.
kaspersky.com
Open sourcekaspersky.ru
Open sourcethehackernews.com
Open sourcecysecurity.news
Open sourcehannesweissteiner.com
Open sourceopennet.me
Open sourceopennet.ru
Open sourcehannesweissteiner.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A serious unpatched **Chromium** vulnerability was accidentally exposed after Google engineers marked the issue as fixed without shipping a patch, causing the bug report and proof-of-concept to become public. The flaw, originally reported in 2022, abuses the **Background Fetch API** to keep a Service Worker and malicious JavaScript running after the browser is closed and, in some cases, even after a device reboot. Affected products include **Chrome**, **Microsoft Edge**, **Brave**, **Opera**, **Vivaldi**, and **Arc**. The bug could let attackers abuse victims’ browsers for proxying traffic, launching DDoS activity, opening websites, and tracking user behavior; Google later re-hid the report and said it is working on a fix. Separately, researchers analyzing the **VoidStealer** infostealer found it can bypass Chrome’s **Application-Bound Encryption (ABE)** on Windows by attaching to the browser as a debugger, intercepting the moment Chrome decrypts protected data, and extracting the master key from memory. That technique enables theft of cookies, sessions, and other sensitive browser data, and the risk extends to other Chromium-based browsers using the same protection model. Together, the disclosures show that Chromium ecosystems face both browser-level persistence abuse and post-compromise data theft, with defenders urged to watch for unusual download-menu behavior, keep browsers updated as fixes arrive, and harden endpoints against infostealer activity.
Jun 29, 2026
Researchers disclosed the speculative-execution attacks **Meltdown** (`CVE-2017-5754`) and **Spectre** (`CVE-2017-5753`, `CVE-2017-5715`), showing that modern Intel, AMD, and ARM processors could leak sensitive data across privilege boundaries through cache-timing side channels. Google Project Zero demonstrated kernel and virtual-machine memory disclosure, while browser vendors including Mozilla confirmed that web content could abuse similar techniques, prompting Firefox to reduce timer precision and disable `SharedArrayBuffer` by default. Microsoft, Apple, Linux distributors, cloud providers, and hardware vendors issued operating-system, browser, and microcode mitigations, with Microsoft saying Azure had already been updated and Intel later announcing hardware changes for future chips. Early mitigation rollouts brought significant operational concerns, including uneven performance degradation and unstable firmware updates. Linux and macOS testing found that common desktop benchmarks often changed little, but syscall-heavy, storage, and IO-intensive workloads could slow noticeably, with some macOS microbenchmarks degrading by roughly **2x to 4x** and Windows Server or older systems expected to see larger impacts than newer Windows 10 devices. Intel’s early Spectre-related microcode updates were later linked to reboots and possible data corruption, leading Microsoft to publish an emergency update that disabled one mitigation path, while vendors such as Dell and NetApp tracked product exposure and remediation guidance as the industry continued responding to follow-on speculative-execution issues.
Aug 8, 2026
Researchers disclosed the **Meltdown** and **Spectre** hardware flaws, showing that speculative execution in modern processors could let attackers read sensitive data across security boundaries on affected devices. Reuters reported that **Meltdown** primarily affected Intel processors by breaking memory isolation, while **Spectre** impacted Intel, AMD, and ARM chips by tricking applications into leaking secrets such as passwords and other protected data. CERT/CC later summarized the broader issue as cache side-channel attacks against CPU hardware using speculative execution, underscoring that the weakness was architectural rather than limited to a single product line. Major vendors and cloud providers moved to contain the fallout with software, firmware, and microcode mitigations, including Microsoft Azure protections for hosted customers and public advisories from manufacturers such as Huawei. Subsequent research showed the problem persisted beyond the initial disclosures: the **ZombieLoad** attacks demonstrated additional Intel data-leakage paths tied to speculative execution, and a later **TSX Asynchronous Abort (TAA)** variant affected some processors previously thought to be resistant. Intel issued microcode updates, but researchers and vendors warned that mitigations reduced rather than eliminated risk, that exploitation generally required local code execution, and that fully disabling the underlying CPU behavior would carry significant performance costs.
Jun 29, 2026