Spectre2 should allow malicious JavaScript to read data from other processes.
Running browser tabs in separate processes (e.g. Google Chrome's new Site Isolation) should protect data from Spectre1 alone but not Spectre2.
See the table here:
https://security.googleblog.com/2018/01/more-details-about-m...
If that's not right I'd love to be corrected.
Probably no known exploit of this yet.
Speaking as a layman:
Running on the same physical core is a pretty common case on laptops.
Sharing a library with your target is probably a very common case. For instance, libc.
Last few tickets I filed with Coinbase took days/weeks/never to get a response. Others seems to have a similar experience: https://www.reddit.com/r/Bitcoin/comments/735yqe/how_do_you_...
>> However, there are a few actions you should take right now to limit your exposure ...
None of the actions suggested includes the action of keeping cryptocurrency in user's own deterministic wallet to avoid any exposure from Coinbase side.
Only run Javascript on domains you really need and trust, and even then the minimum amount required for the site to function.
This is so inconvenient that practically no one is going to do it. I used to use NoScript but found I was just constantly clicking "temporarily allow."
But I'm just inferring that from Google's security blog posting; I can't say with real expertise.
Would love for an expert to chime in.
My understanding is that Spectre will allow an attacker to read any memory anywhere in userspace, so yes, that would include the clipboard. Meltdown is just an enhancement to Spectre that allows it to also read into kernel space (ring 0). Spectre is the systemic issue that accurately deduces memory values based on CPU cache heat. Meltdown is the implementation-specific issue, which affects many ARM SKUs and virtually all Intel SKUs, that makes privileged memory susceptible to the same.