DROW: Training-Free Load Speculative Execution Attacks on Apple Silicon
Published in 2nd Microarchitecture Security Conference (uASC'26), 2026
Traditional speculative attacks rely on training hardware predictors, limiting practicality. We present DROW, exploiting blind bypassing on Apple silicon, where loads speculatively bypass stores without training. This primitive circumvents mistraining defenses to hijack data and control flow. DROW achieves $16.3\times$ higher bandwidth than prior art, enabling practical exploits including cross-page browser leakage, ASLR/KASLR bypassing, and PAC circumvention.