Related question about spectre and the cross-process(!?) mem read possibility: the attacker "influences the victim to execute the gadget speculatively.", and then the "areful selection of a gadget" (i.e. in the victim process) can be used to read arbitrary victim memory.

How is that possible? I can understand an attacker reading its own memory, but foreign one via a common mapped gadged section... that is just incredible!