Multiple Spectre variants (RDCL, RSRR, Lazy FP state restore, SpectreRSB) bypass process boundaries. It doesn’t matter what IPC mechanism you use, they can read arbitrary privileged memory no matter who owns it.

IPC really has nothing to do with anything, Spectre-wise; you don’t have to be using any IPC mechanism in either the attacker or attackee process to be vulnerable to these variants.

I see, need to educate myself better on the subject then.