AFAIK, there are two ways to represent a capability. One way would be through a cryptographic token or key, where knowledge of that token or key allows using th

AFAIK, there are two ways to represent a capability. One way would be through a cryptographic token or key, where knowledge of that token or key allows using the capability; in that case, a side channel attack which leaks that token or key would allow privilege escalation. The other way is to represent the capability as an index in a per-process or per-thread table managed by the operating system, similar to how Unix file descriptors work. In this case, a side channel attack does not help, since knowledge of the capability is not enough; you have to convince the operating system to add it to your capability table.