JavaScript and WebAssembly. See MDS (https://en.wikipedia.org/wiki/Microarchitectural_Data_Sampling https://en.wikipedia.org/wiki/Microarchitectural_Data_Sampli

JavaScript and WebAssembly. See MDS (https://en.wikipedia.org/wiki/Microarchitectural_Data_Sampling https://en.wikipedia.org/wiki/Microarchitectural_Data_Sampli...), a non-exclusive class of vulnerabilities of which ZombieLoad was but one proven exploit, Portsmash (https://www.theregister.co.uk/2018/11/02/portsmash_intel_security_attack/ https://www.theregister.co.uk/2018/11/02/portsmash_intel_sec...), and others. Here's a good paper (pre Spectre) that surveys various timing attacks and how they relate to specific architectural features: Qian Ge, Yuval Yarom, David Cock, and Gernot Heiser, "A Survey of Microarchitectural Timing Attacks and Countermeasures on Contemporary Hardware", https://eprint.iacr.org/2016/613.pdf https://eprint.iacr.org/2016/613.pdf.