New Apple CPU side-channel attacks steal data from browsers

Researchers revealed two remote speculative-execution side-channel vulnerabilities in Apple M‑ and A‑series CPUs—FLOP (false load output prediction) and SLAP (speculative load address prediction)—that enable malicious JavaScript/WebAssembly on a webpage to escape browser sandboxes and leak cross-origin sensitive data such as emails, calendar events, location history and browsing activity; PoC demonstrations exist and Apple was notified but fixes were not yet available at the time of reporting.