> We leak a string from another process using Javascript and WebAssembly in the SpiderMonkey engine.

They leak in flight data, using a detached spidermonkey engine, patched to make performance.now() return rdtscp at a rate of 1B/s while the victim application is spamming a load string instruction as fast as possible.

This does not allow:

>any ad network can access any and all memory on your desktop

This allows any ad-network to access random bits on the cache line. If the timing mitigation didn't already fix this, it seems impossible to me to get anything useful from it, the precision and bitrate is just too low (which is why the exploit just spams load instructions in a while 1 loop).

>and the RIDL exploits don't require special instructions.

Weird, in the new addendum it says it uses TSX, and in the PoC it uses XBEGIN. Must be a mistake.