It also consumes lots of CPU to scan memory this way, so just be on the lookout for webpages consuming lots of unexpected CPU.

JS as an attack vector can be effectively mitigated by denying access to high-precision timers (and a few features that can be used to construct high-precision timers). At least Chrome and Firefox are doing this, so just make sure that you are keeping your browser up to date.

If you feel paranoid, you might also want to disable JS by default and only enable by whitelist on any machines that hold particularly sensitive or valuable data.

Yeah, it's possible to use to bypass same origin policy and read data across origins. Basic idea is that most browsers have multiple origins in the same process, meaning that the same speculative execution + optimistic caching can leak data to js from another origin in the same process.