Google had a decent writeup and proof of concept for leaking via JavaScript: https://security.googleblog.com/2021/03/a-spectre-proof-of-concept-for-spectre.htm

Google had a decent writeup and proof of concept for leaking via JavaScript: https://security.googleblog.com/2021/03/a-spectre-proof-of-concept-for-spectre.html https://security.googleblog.com/2021/03/a-spectre-proof-of-c... As for clouds, "retpoline" is (was?) a common measure taken against spectre v2, as seen in this fairly old post: https://cloud.google.com/blog/topics/inside-google-cloud/answering-your-questions-about-meltdown-and-spectre https://cloud.google.com/blog/topics/inside-google-cloud/ans... What retbleed means for this is anyone's guess, but I'd hazard a thought that it's not great.