Processor companies have been in a dead sprint trying to make machines superpowered. They pushed speeds 20-30% higher by ignoring little things like security, and the cat is out of the bag now. Meltdown allows applications to access data being used by other applications using the same processor core without any additional permissions. Fixes will hurt multitasking performance. Chrome’s core isolation security fix will increase its already ridiculous memory usage by about 30%. The good thing is it can be patched. The bad is that it’ll create noticeable slowdowns. Fortunately, it only affects machines using Intel-based processors. AMD and ARM aren’t vulnerable to it.

Spectre uses speculative execution (processor making assumptions about which memory locations and such it’ll need to use to push processing speeds) to pull unrelated data to the process. When it is sent to the wrong location, the unrelated data remains readable by the process and data that would normally be encrypted is visible. It’s more random, like Heartbleed was, and very difficult to target, but it’s currently unpatchable and affects every processor since the Pentium II (everything from your Smartphone to your toaster at this point). Literally, CERT’s true fix is throw it out and wait for something that doesn’t have this problem. There’s some crazy geniuses coming up with patches that’ll mitigate it, but it happens at the lowest level of the processor core, so firmware won’t fix it flat out.

Meltdown is far more dangerous right now. Someone could put code in their site to read data being handled in another browser tab. Patching that is a priority.