A year with Spectre: a V8 perspective

Here's an article on the V8 blog
describing the work that was done to mitigate Spectre vulnerabilities in
the V8 JavaScript engine. 'Our research reached the conclusion that,
in principle, untrusted code can read a process’s entire address space
using Spectre and side channels. Software mitigations reduce the
effectiveness of many potential gadgets, but are not efficient or
comprehensive. The only effective mitigation is to move sensitive data out
of the process’s address space.'