Browser-laptop: Brave reports as vulnerable to spectre on test site

[g33xter]

Test plan

https://github.com/brave/browser-laptop/pull/12577#issue-287200894

---

I'm using Brave 0.19.131 & checked the new security feature which is related to Spectre & Meltdown vulnerability. So, I tried using this http://xlab.tencent.com/special/spectre/spectre_check.html, it's saying it's vulnerable for Spectre. Check the Screenshot. I'm using macOS Sierra.

[srirambv]

cc: @diracdeltas
Same on Chrome for reference

[g33xter]

You need to enable manually, I guess. use this link chrome://flags/#enable-site-per-process.

I don't have any issues with Chrome/Firefox/Safari, they are not vulnerable on newer updates.

[srirambv]

Thanks for the confirmation @g33xter

[diracdeltas]

Strict Site isolation only mitigates against Spectre by enhancing separation between iframes and the parent context. It does not prevent Spectre if the parent context is trying to use the attack against you. According to @jumde, we will need to disable SharedArrayBuffer in order to appear as "not vulnerable" according to this test.

[srirambv]

Works on Windows

[srirambv]

Worked on Linux as well

[LaurenWags]

MacOS using 0.19.132:

[g33xter]

@diracdeltas thanks for clarifying.