Browser makers long ago turned simple web pages into sophisticated platforms. Now that power comes with fresh privacy costs. A team of researchers has shown how any website can infer what other sites a visitor has open and which applications run on their device. They do it by measuring subtle timing changes in solid-state drive activity. All from ordinary JavaScript. The method carries the name FROST. It stands for fingerprinting remotely using OPFS-based SSD timing. Ars Technica first detailed the work in late May. The underlying research paper appeared from scientists at Graz University of Technology. Here is how it operates. A page creates a large file inside the browser’s Origin Private File System. This API gives websites private storage without prompting the user. The attacking script then performs repeated random reads from that file. It times each operation with high precision. Other tabs, other browsers, even desktop programs generate their own storage traffic. They compete for the same SSD.…