ty_ger07

NereusWe could convince ourselves this is still an obstacle, but we should first be prepared to disable JavaScript (and similar) in the browser...

Our experience is heavily controlled by JavaScript.  Many sites stop working without JavaScript.  JavaScript has become a cornerstone of our internet experience.  Right now we are seeing content which was provided to us by JavaScript.
 
No one should ever confuse JavaScript with Java.
 
Usually mitigation is put in place inside of the JavaScript framework for known vulnerabilities, but ultimately you can't expect a framework to be aware of, detect, and prevent all attacks.  JavaScript is an immensely universal, often simple, but ultimately an enormously powerful and capable attack vector.
 
With these Intel speculative attacks, over and over people have repeated how safe they feel, how impossible it is to exploit the speculative attacks, and mostly they over and over talked about needing physical access to the machine.  Over and over I have pointed out that JavaScript has time and time again proven to be a capable attack vector.  All you have to do is have an unpatched machine/browser/JavaScript framework, spend enough time on a compromised multimedia streaming website or stock/news ticker site, and that's it!  Since JavaScript operates "client side" there is not necessarily any detectable suspicious network activity prior to the JavaScript finding whatever it is programmed to find and sending it back to mother.  Unmitigated, the speculative attacks give the attacker access to absolutely anything in memory regardless of any previously-existing attempts to prevent it.  Sandboxing did nothing.  Antivirus did nothing.  Restricting memory addresses did nothing.  Kernel protections did nothing.  "Physical access" is a hugely misleading term.