iLeakage: Browser-Based Timerless Speculative Execution Attacks on Apple Devices

Re:iLeakage: Browser-Based Timerless Speculative Execution A... by kickdaddy on Wednesday October 25, 2023 @02:21PM (#38016288)

For standard Safari (not technology preview) 17.0 on Ventura "Swap Processes on Cross-Site Window Open" is already enabled (and labeled Stable) for me. I did not enable it so it's possible Apple already enabled this and their description of how to enable etc. is out of date.

[ Parent | on HN ]

Re:iLeakage: Browser-Based Timerless Speculative Execution A... by t-sauer on Wednesday October 25, 2023 @02:28PM (#38016392)

I also checked on my iPhone which I just upgraded to 17.1 and the flag is present and already enabled there as well.

Edit: Seems like I got confused by the other very similar feature flag as well.

[ Parent | on HN ]

Re:iLeakage: Browser-Based Timerless Speculative Execution A... by cedws on Wednesday October 25, 2023 @02:31PM (#38016435)

They disclosed this vulnerability today but it appears the information on the vuln scare site is outdated. Bit sloppy.

[ Parent | on HN ]

Re:iLeakage: Browser-Based Timerless Speculative Execution A... by fh9302 on Wednesday October 25, 2023 @02:39PM (#38016558)

I think users here, including myself, got confused because there is a feature flag that has a similar name.

"Swap Processes on Cross-Site Navigation" is enabled by default, but this paper recommends "Swap Processes on Cross-Site Window Open".

[ Parent | on HN ]

Re:iLeakage: Browser-Based Timerless Speculative Execution A... by fh9302 on Wednesday October 25, 2023 @02:25PM (#38016346)

Also enabled by default for me on macOS 14.1.

Edit: It appears I confused it with a similarly named flag. It doesn't appear to be enabled on macOS yet by default.

[ Parent | on HN ]

Re:iLeakage: Browser-Based Timerless Speculative Execution A... by X-Istence on Wednesday October 25, 2023 @02:31PM (#38016433)

I am on macOS 14.0 with Safari 17.0 and the feature is enabled by default.

[ Parent | on HN ]