New ‘FROST’ Web Attack Lets Sites Spy on Apps and Activity With No Permissions
Severity: WARNING
Detected: 2026-06-09T10:17:41.102Z
Summary
Security researchers warn that a technique dubbed FROST allows any website you leave open in a tab to infer which apps you launch and which sites you visit—with no downloads, prompts, or permissions. For governments, banks, and trading desks that rely on browser isolation, this quietly breaks a key layer of operational security and raises fresh compliance and surveillance‑risk questions.
Details
A newly disclosed cyber technique known as the FROST attack could quietly upend how secure institutions treat web browsing, by allowing ordinary websites to track what users are doing across their computers in near real time. According to security reporting posted at 10:00 UTC on 9 June, FROST uses nothing more than JavaScript running in an open browser tab to time SSD operations and infer, with up to 95% accuracy, which sites and applications a user is opening—without any download, popup, or explicit permission.
The core claim is that FROST turns storage‑device timing into a high‑fidelity side channel: by continuously measuring how long SSD reads and writes take, malicious scripts can distinguish different usage patterns associated with specific applications and websites. Because this takes place entirely within standard browser capabilities, current permission models do not block it, and there is reportedly no complete fix yet available from browser or OS vendors. Source is a detailed technical disclosure carried by The Hacker News; we assess the underlying research as credible given past accurate reporting on side‑channel techniques.
For real people and institutions, the stakes go beyond abstract privacy. Any user who keeps a malicious tab open—whether from a phishing email, a compromised news site, or a poisoned ad—could be passively profiled. High‑value targets include bankers working on confidential deals, traders executing sensitive orders, government officials accessing classified portals from mixed‑use machines, journalists protecting sources, and corporate staff handling M&A or sanctions‑sensitive plans from laptops that also browse the open internet.
Financially, FROST threatens one of the quiet assumptions underpinning many trading and banking workflows: that keeping specific apps and sites in separate windows, or relying on browser permissions, is enough to prevent cross‑context leakage. A compromised tab could infer when a trading terminal or internal risk dashboard is opened, when secure messaging or VPN clients are launched, or when a user accesses particular competitor or regulator portals. While it does not by itself read message content, timing and correlation alone can reveal deal activity, trading rhythms, or sensitive research behavior.
From a security perspective, this enlarges the attack surface for both intelligence services and sophisticated criminal groups. State actors could use FROST‑style techniques for long‑term behavioral surveillance of diplomatic, military, or corporate targets, especially in countries where browser isolation—rather than full hardware separation—is widely used. Criminals could pair FROST telemetry with credential theft to better evade fraud detection by mimicking genuine user behavior, or to identify when users are most exposed for account takeover.
Market and sector impact is likely to cluster around cyber‑security and browser/OS ecosystems. Vendors of secure browsers, hardened endpoints, VDI solutions, and privacy tech could benefit as enterprises accelerate segmentation of browsing away from production environments. Conversely, major browser and OS platforms will face pressure to devise mitigations (e.g., throttling high‑precision timers, SSD‑timing obfuscation, or architectural changes), which could add overhead and provoke regulatory scrutiny about web‑tracking and security defaults.
In the next 24–48 hours, watch for: (1) technical advisories from major browser projects (Chrome, Edge, Firefox, Safari) acknowledging or disputing FROST feasibility and outlining interim mitigations; (2) guidance from national cyber agencies (CISA, ENISA, NCSC, etc.) to financial institutions and government users on browser‑use policies; (3) any exploitation reports in the wild, especially against financial, energy, or government networks; and (4) shifts in enterprise policy—such as emergency restrictions on non‑work browsing from trading and control‑system endpoints—that could temporarily disrupt operations but reduce exposure.
MARKET IMPACT ASSESSMENT: Near‑term focus on cyber‑security names and privacy‑tech providers; possible pressure on major browser vendors and OS makers to mitigate SSD‑timing vectors. Financial institutions, HFT desks, and funds may need rapid browser/endpoint policy changes, driving short‑term operational friction. Elevated cyber‑risk perception can support security software equities and marginally weigh on big‑tech advertising and data‑harvesting narratives if regulators react.
Sources
- OSINT