Blessed Spook.js, Specter of the Browser

Patron of tabs open on the same domain, extensions living too close together, and processors that guess the future.

Life

On 8 September 2021 researchers from the University of Michigan, the University of Adelaide, Georgia Tech and Tel Aviv University, among them Daniel Genkin and Yuval Yarom, unveiled Spook.js. It was a Spectre-style attack written in JavaScript that got around Chrome's Site Isolation when pages or extensions ended up sharing a process: in their tests they read credentials from the memory of a password manager extension. Google had already tightened isolation in Chrome 92.

Prayer

O Blessed Spook.js, specter who haunts the cache, stay shut in your own process and do not peer into the neighbours' tabs. Amen.

How to celebrate

Celebrated by keeping Chrome up to date with strict extension isolation on, and installing fewer extensions.

A process shared is a secret halved.