Branch Privilege Injection: Compromising Spectre v2 Hardware Mitigations by Exploiting Branch Predictor Race Conditions. - Sandro Rüegge; Johannes Wikner; Kaveh Razavi (USENIX Security Symposium, 2025)