Spook.js

Spook.js Attacking Google Chrome's Strict Site Isolation via Speculative Execution and Type Confusion Spook.js is a new transient execution side channel attack which targets the Chrome web browser. We show that despite Google's attempts to mitigate Spectre by deploying Strict Site Isolation, information extraction via malicious JavaScript code is still possible in some cases. More specifically, we

[b-wind]

“Attacking Google Chrome's Strict Site Isolation via Speculative Execution and Type Confusion”

[Shisama]

“Attacking Google Chrome's Strict Site Isolation via Speculative Execution and Type Confusion ”

[efcl]

leaky.page が同じページ内での話だったの対して、ウェブサイト間や拡張機能間まで話を広げたSpectreについての論文。 Chromeはメモリを圧迫するとeTLD+1の範囲でプロセスがまとまる。まとまったプロセス内でV8の癖を使って投機