Spectre
Class of CPU vulnerabilities (CVE-2017-5753/5715, Jan 2018) that abuse branch prediction and speculative execution to leak memory via cache timing.
Variant 1 (bounds check bypass): train a branch so the CPU speculatively reads past an array bound; even after the bound check fixes the mistake, the cache has been modified. Variant 2 (branch target injection): train an indirect branch so the wrong function executes speculatively. Affects Intel, AMD, ARM, IBM.
Mitigations: retpolines, IBPB/IBRS/STIBP MSRs, microcode updates, __user pointer sanitizer in the kernel. Performance cost 0–15 %. Spectre opened the "speculative execution attacks" field — dozens of variants since.