As expected, researchers find another side-channel processor attack that abuses branch prediction, called BranchScope, similar to Spectre variant 2
Peter Bright / Ars Technica :
Context & Ripple Effects
Two months after Meltdown and Spectre ended their seven months of secrecy, the disclosure pipeline is running hot: researchers have already turned speculative execution into a JavaScript attack that breaks browser sandboxing and an SgxPectre assault on Intel's SGX enclaves. BranchScope extends that run with a side channel built specifically on branch prediction, the same mechanism Spectre variant 2 abuses.
The significance is less any single leak than the cadence: each new variant arrives faster than vendors can ship microcode, and the class keeps widening — from browsers to secure enclaves — before defenses settle.
First-order effects
- Intel and other affected chipmakers face another branch-prediction side channel to address through microcode and OS-level mitigations, adding to the patch load already shipped since January.
- Browser vendors must treat branch prediction as an exploitable timing surface inside their sandboxes, not just the memory-disambiguation path the original JavaScript Spectre demo used.
Second-order effects
- Every new variant strengthens the argument Google's researchers later made that software patches are inadequate because their performance cost is too high — pushing the burden back onto hardware designers.
- Enclave-dependent products (SGX-based DRM, key protection) inherit fresh risk each time a variant like BranchScope or Foreshadow lands, forcing Intel to defend trusted execution as a moving target.
Third-order effects
- If the pattern holds — variants like the Spectre-like attack with no known mitigation and the micro-op cache exploit defeating all current mitigations keep appearing — speculative-execution side channels become a permanent tax on CPU design, forcing architects to trade performance for predictability rather than patch after the fact.
The trend: Speculative-execution side channels are maturing into a standing research class where each disclosed variant outruns the mitigation cycle, shifting security responsibility from software patches toward processor architecture itself.