Spectre returns as Branch Target Reuse, a practical attack on JIT engines

The Spectre microarchitecture vulnerability has returned, this time to trouble the just-in-time (JIT) engines that generate machine code for browsers, runtimes, and kernels. The finding comes from researchers at Vrije Universiteit in the Netherlands and Scuola Superiore Sant'Anna in Italy.

Speculative execution and side channels

Speculative execution lets a processor run code before it is actually called, which boosts performance. It is also what opens the door to side-channel attacks: the chip touches secret data and then discards the result architecturally, but a trace survives in cache behavior and timing; reading that trace is enough to infer the secret.

When Spectre and Meltdown became public in 2018, chipmakers and OS developers rushed to fix them, and researchers have since found two or three dozen variants. One is 2025's VMScape, a Spectre v2 attack that goes after indirect branch prediction. In an indirect branch the program points to an address where the next instruction lives rather than naming it, and an attacker trains the branch predictor to speculate to a chosen address.

Branch Target Reuse

The team of Sander Wiebing, Yuhui Zhu, Alessandro Biondi, and Cristiano Giuffrida revived Spectre in a form called Branch Target Reuse (BTR), the first practical in-place Spectre v2 attack against JIT compilers. An in-place attack is confined to the victim's branch; an out-of-place attack speculates toward a target on a different branch.

The researchers conjured BTR from code left in JIT engines including Linux cBPF, Oracle GraalVM, and Mozilla SpiderMonkey. As they explain it, modern CPUs restore architectural code coherence after self-modification but do not necessarily invalidate stale indirect branch prediction entries. When the code cache is repopulated, those entries can be reused, yielding a speculative execute-after-free primitive.

Impact and mitigations

That lets an attacker commandeer speculative control flow while dodging some software defenses such as FineIBT. The researchers built two proof-of-concept exploits against an Intel-based Linux kernel and recovered the root password hash even with the constant binding defense that cBPF provides. The expected leakage rate is 5.7 KB/sec on Intel Raptor Cove chips and 5.4 KB/sec on Lion Cove, slow but enough for an unprivileged user.

After disclosure, Linux kernel developers and Oracle put mitigations in place, and two CVEs were assigned: CVE-2026-64507 and CVE-2026-64508. Mozilla opted to prioritize work on site isolation rather than address the issue directly. Strong mitigations such as IBPB are effective but cost performance. The Branch Target Reuse paper has been accepted at the ACM Conference on Computer and Communications Security (CCS) 2026, held November 15-19 in The Hague, Netherlands.