I've read that it's possible to exploit meltdown or spectre just with javascript. Apparely it's now patched with most browsers. Other than js, am I right to th

I've read that it's possible to exploit meltdown or spectre just with javascript. Apparely it's now patched with most browsers. Other than js, am I right to think it's still a difficult vulnerability to exploit since you need to execute code on a target machine? It seems to be bad news for cloud techs, but not for users.