security-research-pocs

> Suppose I'm a typical desktop user, how is important information going to be stolen if I have mitigations turned off and JavaScript enabled? https://github.com/google/security-research-pocs/tree/master... I don't imagine I'm going to explain it better than the many others who have already done so. > What state does my browser have to be in, and what actions do I have to take (or not take) for the attack to succeed? Your browser would have to be pretty old/ outdated since they've been updated to mitigate these attacks. Otherwise it's just necessary that you visit the attacker controlled website. > What likelihood is it that someone has deployed an attack that meets those requirements? That's not a simple question. Threat landscapes change based on a lot of factors. As I said earlier, we won't see these attacks because people have already

That specific PoC page relied on performance.now() https://github.com/google/security-research-pocs/blob/d10780... Chrome has limited "performance.now" to have a relatively low resolution: https://chromium-review.googlesource.com/c/chromium/src/+/85... Also, "2018 install of win10", you might have already been patched during install. The chrome patch was Jan 2018. Microsoft also rolled out their first specture/meltdown mitigations at the OS level in January 2018.