Comment by timschmidt

> not all systems are vulnerable to undervoltage attacks. For example, I don't think the iphone secure enclave is vulnerable to this.

Then there's decapping / depotting, a world of different types of microscopy - some destructive some not, directed EM attacks, etc.

> And good security uses "defence in depth"

And automation has enabled "offense in depth"

> To hack chrome, you need a vulnerability in the renderer or VM. Then you also need a sandbox escape, and a way to use that to attack the browser's parent process.

Or you just phish the user into installing your exploit. There's always another layer. Always a potential exploit. Because ultimately the same properties of the universe which permit computation within a closed system allow for predictably observing and influencing it. The expense and hassle of doing so are widely variable, of course.