3 ms·
No, the POC only shows the script leaking memory into javascript running within the same process, and thus the same site. Chrome is still preventing the info f
by toomim 6y ago
No, the POC only shows the script leaking memory into javascript running within the same process, and thus the same site. Chrome is still preventing the info from leaking across sites.
- jeffbee 6y agoThat's why there was the recent W3C draft about Spectre and the policies around which sites can frame other sites.
- ddworken 6y agoThe big caveat to this is that an attacker can generally get a browser to include a cross-site resource in their process. For example, `<img src="https://sensitive.com/myprofilepic.png https://sensitive.com/myprofilepic.png">` will cause the image to be loaded in the attacker's process where they can then potentially steal it. The article "Post-Spectre Web Development" goes into details on how sites can defend against this (and other vectors).