Spectre works in javascript due to how aggressive the JIT is. Chrome and Firefox are already working on solutions as you cannot exploit the JIT if it generates

Spectre works in javascript due to how aggressive the JIT is. Chrome and Firefox are already working on solutions as you cannot exploit the JIT if it generates code that ruins your timing as far as I'm aware. So that solves the problem for most people, but all other environments that allow execution of untrusted code also need to be updated.