Spectre has resurfaced in a new form called Branch Target Reuse (BTR), developed by researchers from Vrije Universiteit in the Netherlands and Scuola Superiore Sant'Anna in Italy. The attack targets just-in-time (JIT) engines that generate machine code for browsers, runtimes, and kernels. Unlike earlier out-of-place Spectre v2 attacks, BTR is an in-place attack confined to the victim's branch, making it the first practical in-place Spectre v2 attack against JIT compilers.
The core insight is that modern CPUs restore architectural code coherence after self-modification but do not necessarily invalidate stale indirect branch prediction entries. In JIT engines, these stale targets can outlive the original code and later be reused when the code cache is repopulated, yielding a speculative execute-after-free primitive. The researchers demonstrated two proof-of-concept exploits against an Intel-based Linux kernel that revealed the root password hash, with expected leakage rates of 5.7 KB/sec on Raptor Cove chips and 5.4 KB/sec on Lion Cove.
After disclosure, Linux kernel developers and Oracle put mitigations in place, and two CVEs were assigned. Mozilla, according to the researchers, opted to prioritize work on site isolation instead of addressing the issue directly. Strong mitigations like IBPB are said to be effective but add complexity and hinder performance. The BTR paper has been accepted for publication at ACM CCS 2026, to be held in The Hague this November.