What do you mean "no known exploits"? The authors of the paper have an exploit that reads arbitrary system memory from a browser. And even after the meltdown patches, spectre "fixes" we have seen are only partial mitigation, and still potentially allow reading of passwords and third party cookies. But I guess if you want to wait til it's too late...

What do you mean by “no known exploits”? There are several PoCs out, one of which is in JavaScript for meltdown.

Yea sounds like you need all the CPU you can get. Good decision.