Researchers disclosed a new Spectre v2 attack variant called Branch Target Reuse that can leak sensitive data from systems using Intel, AMD, and Arm processors. The attack abuses stale indirect branch prediction entries left behind after just-in-time compiled code changes at runtime, affecting Linux cBPF, Mozilla Firefox's SpiderMonkey engine, and Oracle GraalVM. The team built end-to-end Linux kernel exploits that leaked the root password hash on fully updated systems; no CVE is cited in this report.
Why it matters: This is a broad cross-vendor CPU side-channel issue that can bypass expected protections even on patched machines, with potential paths from local code execution and possibly malicious web content. Defenders should watch for vendor guidance, limit untrusted code execution where possible, and track browser, kernel, and runtime mitigations rather than assuming existing Spectre defenses are sufficient.
2026.09.30
95% relevant
This is the same underlying disclosure of the Branch Target Reuse Spectre v2 attack, adding concrete affected JIT targets called out in the article (Linux cBPF, Oracle GraalVM, Mozilla SpiderMonkey), the assigned CVEs CVE-2026-64507 and CVE-2026-64508, proof-of-concept leakage of a Linux root password hash, and notes on mitigations from Linux and Oracle plus Mozilla's response.
Eduard Kovacs
2026.09.29
100% relevant
This article establishes a distinct new hardware vulnerability story centered on the newly disclosed Branch Target Reuse Spectre v2 variant and its demonstrated impact across CPUs, kernels, browsers, and language runtimes.
← Back to all stories