OCCUPY+PROBE: Cross-Privilege Branch Target Buffer Side-Channel Attacks at Instruction Granularity. - Kaiyuan Rong; Junqi Fang; Haixia Wang 001; Dapeng Ju; Dongsheng Wang 002 (NDSS, 2026)