No, Spectre breaks (reads) kernel memory too, and the authors are explicit about this in their paper. It allows you to attack any security domain you can "call

No, Spectre breaks (reads) kernel memory too, and the authors are explicit about this in their paper. It allows you to attack any security domain you can "call out" on the local host, whether it is some other process, another security domain in the same process (e.g., a JIT running JavaScript) or the kernel. The authors used JavaScript and cross-Hyperthread/process disclosures as their primary examples probably because at leas the former is especially devastating given the ease of running JavaScript remotely when someone visits a malicious website, and because it differentiates it from Meltdown (which is mostly only about reading kernel memory) - but executing either variant is even easier against kernel syscalls (no need to attack across the JIT layer). The huge amount of work been done on kernels to mitigate Spectre is evidence of this.