🌐 Chapter 67: CORS & Cross-Origin Embedding

Spectre & Meltdown Hardware Attack Mitigations in HTML/JS

**Part 14: Security & Best Practices** — Chapter 67: Cross-Origin Resource Sharing (CORS) & Embedding

LEARNING OBJECTIVES ⌵
  • Understand speculative execution side-channel hardware vulnerabilities (Spectre / Meltdown).
  • Learn how micro-architectural CPU branch predictors can be tricked into leaking memory addresses across web origins.
  • Understand browser defenses: Timer resolution coarsening (5$\mu$s jitter) and Site Isolation process partitioning.
  • Build secure cryptographic code in JavaScript immune to cache-timing attacks.
🎬 INTERACTIVE VISUAL PIPELINE Core Architecture Simulation
🌐
1. Input
Directives & Tags
⚙️
2. Parse
Tokenizer & AST
🌳
3. Layout
Box Model & Flow
🎨
4. Render
GPU Paint & Composite
PHASE 1: INPUT & DIRECTIVES
Browser receives declarative markup stream, parsing tag tokens and initializing component state.

📖 The Threat: Speculative Cache Timing

Modern CPUs execute instructions ahead of time ("speculatively") before branch conditions finish evaluating. Even if the branch condition is false and the CPU discards the result, the data loaded during speculation leaves a physical heat/cache footprint in the L1 CPU cache.

By measuring the exact duration (in nanoseconds) required to access an array, a malicious web script could deduce private cryptographic keys or passwords residing in adjacent memory processes.

Speculative Execution Footprint:
Array Access Time:
- 10ns (Cache HIT)  ===> Attacker knows secret byte was 0!
- 90ns (Cache MISS) ===> Attacker knows secret byte was NOT 0!

📌 Key Takeaways

  • Modern browsers coarsen performance.now() resolution and introduce random timing jitter to defeat nanosecond side-channel attacks.
  • Site Isolation allocates separate OS processes for each web origin (https://bank.com vs https://evil.com).
  • --

❓ Knowledge Check

1. Which of the following is correct?

2. Which of the following is correct?