New Spectre‑v2 “Branch Target Reuse” Variant Threatens Modern CPUs Across Vendors

A newly disclosed variant of the Spectre‑v2 vulnerability, dubbed Branch Target Reuse (BTR), targets the way just‑in‑time (JIT) compilers operate in web browsers, language runtimes and operating‑system kernels. The flaw can be exploited on Intel, AMD and Arm processors, potentially allowing attackers to siphon data from otherwise isolated memory regions.

BTR builds on the classic Spectre‑v2 concept of branch target injection, but focuses on the reuse of indirect branch predictions within JIT‑generated code. When a JIT compiler produces machine code on the fly, it often relies on indirect jumps whose destinations are predicted by the CPU’s branch predictor. By training these predictors to misdirect execution, an adversary can cause speculative execution of attacker‑controlled sequences that read privileged data and leak it through side‑channel mechanisms such as cache timing.

The discovery was first reported by SecurityWeek, which highlighted that the attack surface now includes not only user‑level applications but also core components of the operating system. Because JIT compilation is ubiquitous—in JavaScript engines, WebAssembly runtimes, Java virtual machines and even .NET—the potential impact spans a wide range of software that processes untrusted inputs from the internet.

CPU manufacturers have previously issued microcode updates to mitigate classic Spectre‑v2 attacks, typically by restricting indirect branch speculation or inserting serialization instructions. However, the BTR technique exploits a different facet of branch prediction that existing mitigations do not fully cover. Vendors are expected to evaluate whether additional firmware patches or hardware redesigns are required to close the gap, and analysts warn that the patch rollout could be more complex than prior Spectre fixes.

Software vendors are also under pressure to adapt. Browser developers, for instance, may need to adjust their JIT pipelines to insert more conservative speculation barriers or to employ retpoline‑style constructs for indirect branches. Some open‑source runtimes have already begun reviewing their code generation strategies in light of the new findings, but comprehensive patches are likely to take weeks or months to reach stable releases.

While no public exploits have been demonstrated at scale, the disclosure underscores the enduring relevance of speculative‑execution attacks and the difficulty of fully eradicating them from modern processors. Security researchers and industry stakeholders will be watching closely as patches are tested and deployed, and users are advised to keep their operating systems, browsers and runtime environments up to date to benefit from any forthcoming mitigations.