Researchers: Intel CPUs vulnerable to new “LVI” attacks, which let attackers inject and execute code inside the CPU, theoretically even from a site's JavaScript
Context & Ripple Effects
LVI is the latest entry in a line of Intel silicon flaws that began with Meltdown and Spectre in 2018 and continued through ZombieLoad's disclosure affecting nearly all post-2011 chips in 2019 — each round forcing OS vendors to ship mitigations that trade away performance.
What distinguishes LVI from that lineage is direction: rather than only leaking data out of the CPU, it lets attackers inject and execute code inside it, with researchers flagging website JavaScript as a theoretical delivery path — which would move the threat from local attackers to any page a victim visits.
First-order effects
- Intel faces another patch cycle across its CPU lineup, and OS/browser vendors must again ship mitigations of the kind Apple, Microsoft, and Google released for ZombieLoad — with the same performance cost pattern as the Spectre-era fixes.
Second-order effects
- Cloud providers running Intel fleets have to weigh re-patching against performance loss on shared infrastructure, since a JavaScript-delivered variant would make multi-tenant servers a prime target for code injection rather than just data theft.
Third-order effects
- If each generation of speculative-execution research keeps yielding new attack classes, the structural pressure grows toward hardware redesigns and architectural isolation rather than an endless cadence of microcode patches — a tax on Intel's roadmap that rivals without this flaw history can market against.
The trend: CPU security is settling into a recurring disclosure-and-mitigation cycle where speculative-execution research keeps expanding from data theft toward code execution, pushing the burden from software patches toward hardware architecture.