A possible mitigation is to disable High Precision Timers in JavaScript since the attacks rely on having a timer with nanosecond precision. If you limit the tim

A possible mitigation is to disable High Precision Timers in JavaScript since the attacks rely on having a timer with nanosecond precision. If you limit the timer to microsecond resolution it may not be possible to measure if a cache line has been loaded or not reliably. I could be wrong but this was my first thought for a possible mitigation. EDIT: I was wrong. I guess you would need to disable Web Workers too. JavaScript does not provide access to the rdtscp instruction,and Chrome intentionally degrades the accuracy of its high-resolution timer to dissuade timing attacks using performance.now(). However, the Web Workers feature of HTML5 makes it simple to create a separate thread that repeatedly decrements a value in a shared memory location.