Technology

While I am surprised by the lack of throttling or resource quotas permitting this (assuming they do) I must reiterate that repurposing OPFS this way is, to put it mildly, unrealistic even under optimal conditions. This “API for measuring SSD usage” is quite bad at it.

The meager data this exploit might return will, at best, require excessive cleanup to salvage any value at all. More likely, the data would still be considered worthless due to the expected margin of error and the likelihood that any targets successfully profiled are already well-known via existing datasets.

That said, typically niche-use-case and high-performance APIs that aren’t hidden behind experimental flags require user permission by default (a practice solidified by mitigations of other exploits like mining, fingerprinting, etc) so to find one open and apparently unregulated by default does seem unusual, if true.

Edit: Either way, I suspect any user vulnerable to this exploit is likely already exposed to much worse via similarly unsophisticated but more reliable attacks, and thus has already been heavily profiled.