SetsulThey don't have to be but that doesn't matter.
For the attack to work the executed code needs to be able access the data you want to leak. So if you're not in kernel mode an attack on the kernel will fail because the data is never accessed either a) because the permission check fails (AMD/ARM) or b) because the fix for Meltdown has already flushed the TLB and the adress isn't known.
Sure you can use it to gain access to data in your own process but that's a bit redundant. If your own program contains malicious code and uses it to leak its own data to itself, well, you've achieved nothing.
If you're running untrusted javascript code via JIT in the same process as some sensitive information you might want update your JIT to use conditional bound checks. On the other hand you're running untrusted javascript code via JIT in the same process as some sensitive information so you deserve everything that happens to you.
Not sure what the point of this response was, I wasn't trying to disagree with you that extensively, nor does your defense make sense. The possibility of browser exploitation should not be dismissed and the proper preventative measures should be taken to mitigate it. https://support.google.com/faqs/answer/7622138 (see Google Chrome listing)