The spectre attack is exploitable via javascript and there's no software patch that can fix it. IoW, it is not possible to safely run untrusted code in the same computer that has sentitive information.