FROST: Remote Fingerprinting via OPFS-based SSD Timing (hannesweissteiner.com)

• First use of OPFS API for side-channel attacks
• Covert channel achieves 661 bit/s on Linux
• Website fingerprinting with 88.95% F1 score

"Researchers from Graz University of Technology demonstrate that the Origin Private File System (OPFS) API in browsers can be exploited to measure SSD access times and infer user activities like visited websites or running applications. The attack requires no native code execution and runs within the browser sandbox. It achieves 88.95% F1 score for website identification and 95.83% for application identification."