Cybersecurity glossary
What is Spectre?
Learn what Spectre is, how speculative execution and branch prediction leak memory across software boundaries, major Spectre variants, and practical mitigations for systems and browsers.
Definition
Spectre is a family of speculative execution vulnerabilities in which attackers trick a CPU into transiently executing instructions that access secret data, then recover that data through microarchitectural side channels such as cache timing—often across process, sandbox, or privilege boundaries.
Why Spectre matters
Software isolation assumes CPUs enforce boundaries the same way programmers reason about them. Spectre showed that speculative execution can briefly violate those assumptions and leave measurable traces.
Disclosed publicly in 2018 with Meltdown, Spectre forced industry-wide changes across chipmakers, operating systems, hypervisors, and browsers. It remains a reference point for understanding transient execution risk on shared hardware.
How Spectre-style leaks work
Prepare a side channel
Attacker code sets up cache state and high-resolution timing.
Mis-train predictors
Branch predictors or related mechanisms are conditioned to speculate wrongly.
Transiently access secrets
Speculative instructions read secret-dependent memory before being squashed.
Encode into microarchitecture
The secret selects which cache lines are touched.
Recover bits by timing
Probe timings reconstruct the secret across a trust boundary.
Major Spectre themes
Bounds check bypass (V1)
Speculation past an array bounds check reads out-of-range secret data.
Branch target injection (V2)
Indirect branch predictors are poisoned to speculate into attacker gadgets.
Browser concerns
Untrusted scripts attempt cross-origin leaks without classic memory corruption.
Ongoing variants
New speculation gadgets and buffers continue to yield related CVEs.
Practical mitigations
| Control | Notes |
|---|---|
| Microcode + OS patches | Install vendor updates enabling barriers and predictor controls |
| Retpoline / fencing | Compiler and kernel techniques reduce branch-target injection risk |
| Browser site isolation | Separate sites into processes; reduce precise timer abuse |
| Cloud guidance | Follow provider recommendations for host and guest mitigation status |
| Least sharing | Keep high-sensitivity workloads off hostile multi-tenant neighbors when required |
| Inventory | Track which hosts report mitigations as vulnerable/mitigated/disabled |
- Verify CPU microcode and kernel Spectre mitigations on production hosts.
- Keep hypervisors and cloud images updated to vendor baselines.
- Ensure endpoints run current browsers with isolation features enabled.
- Monitor vendor advisories for new Spectre-class variants.
- Document performance trade-offs of enabled mitigations.
- Review whether untrusted code can run on machines holding crown-jewel secrets.
- Use constant-time crypto libraries to reduce secret-dependent cache effects.
- Include speculation status checks in security configuration baselines.
The practical takeaway
Spectre is a family of speculative execution attacks that leak memory across software boundaries via side channels. Mitigations are layered and evolving—patching and isolation matter more than any single silver bullet.
If untrusted code can run near sensitive data on the same CPU, treat Spectre-class risk as ongoing, not historical.
Related security terms
Speculative Execution Attack
The broader class of transient execution side-channel attacks.
Meltdown
Companion 2018 disclosure focused on kernel memory leakage to user space.
Side-Channel Attack
Parent category for timing and cache-based information leaks.
Cross-Origin Isolation
Browser isolation features that help reduce some cross-site speculation risks.
Frequently asked questions
What is Spectre in simple terms?
Spectre tricks the CPU into briefly touching secret memory while guessing ahead. The guess is undone, but cache timing still reveals what was touched—so secrets can leak to an attacker program.
How is Spectre different from Meltdown?
Meltdown primarily broke the user/kernel isolation on affected CPUs via transient privilege confusion. Spectre is a broader family that tricks speculation within or across software trust boundaries, including via branch prediction.
What are Spectre V1 and V2?
Common shorthand: Variant 1 (bounds check bypass, CVE-2017-5753) and Variant 2 (branch target injection, CVE-2017-5715). Additional variants have been published since.
Can JavaScript exploit Spectre?
Researchers demonstrated browser-based speculative leaks. Browser vendors responded with site isolation, timer reductions, and other mitigations—keep browsers updated.
Is Spectre fully fixed?
Mitigations reduce known variants, but speculative execution remains fundamental. New variants appear periodically; defense is ongoing patching and isolation hardening.
What should operators do?
Apply CPU microcode, OS, hypervisor, and browser updates; follow cloud provider guidance; evaluate mitigation status on critical hosts.
Does disabling hyper-threading help?
Sometimes recommended for specific threats and environments. Follow current vendor guidance rather than applying blanket changes without understanding impact.
References
Explore authoritative guidance and frameworks related to spectre.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.