Collected research

Spectre Attacks: Exploiting Speculative Execution

Paul Kocher, Jann Horn, Anders Fogh, Daniel Genkin, Daniel Gruss, Werner Haas, Mike Hamburg, Moritz Lipp, Stefan Mangard, Thomas Prescher, Michael Schwarz and Yuval Yarom · spectreattack.com

Attackers mistrain a CPU's branch predictors so a victim speculatively executes instruction sequences it never should, then recover the discarded results through cache timing. This reads arbitrary memory across process, kernel, hypervisor and JavaScript sandbox boundaries, leaking keys and tokens from a browser tab or a neighbouring VM.

Record

Researcher

Paul Kocher, Jann Horn, Anders Fogh, Daniel Genkin, Daniel Gruss, Werner Haas, Mike Hamburg, Moritz Lipp, Stefan Mangard, Thomas Prescher, Michael Schwarz and Yuval Yarom

Published by

spectreattack.com

Format

Whitepaper

Topic

Other

In the archive

• Collected in the 2018 research round

Tags

• side-channel
• timing-attack
• info-leak
• sandbox-escape
• javascript
• cve

This page is the archive's own catalogue record. The research is the work of Paul Kocher, Jann Horn, Anders Fogh, Daniel Genkin, Daniel Gruss, Werner Haas, Mike Hamburg, Moritz Lipp, Stefan Mangard, Thomas Prescher, Michael Schwarz and Yuval Yarom, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 14 August 2026.