Here's an example of post-mitigation reading of protected memory using Javascript and Spectre https://alephsecurity.com/2018/06/26/spectre-browser-query-c...

I think it's just silly that you would rely on browser mitigations like disabling high precision timers when that's obviously just a hack.

As is said in the PoC, it does not bypass index masking and site-isolation. They read data already available to the code they are executing. They did show that the timer resolution mitigation is not 100% effective, which is well known and why it is not the only mitigation.

That's not a speculative execution browser 0day, as it doesn't work in updated browsers and it never has (or I guess it works if you want to leak data you could just console.log). Could you post an actual 0day instead?