It is surprisingly difficult to make timekeeping unavailable. There are many methods, besides the official timer APIs, to get timing - as outlined in the paper

It is surprisingly difficult to make timekeeping unavailable. There are many methods, besides the official timer APIs, to get timing - as outlined in the paper "Fantastic Timers and where to find them" from TU Graz: https://www.researchgate.net/publication/322000263_Fantastic_Timers_and_Where_to_Find_Them_High-Resolution_Microarchitectural_Attacks_in_JavaScript https://www.researchgate.net/publication/322000263_Fantastic...