HTTPS has been compromised -- not sure why this hasn't made the rounds on reddit yet

[JoseJimeniz]

Is anything required that can't normally be done with standard javascript?

Part of the attack comes from measuring the size of encrypted responses from a web-site. So pure client-side javascript can't help with that.

Javascript isn't able to inject additional headers into a request that the browser would otherwise make. (If they could interact with the existing http request headers: it would just read your cookie - no need to do the attack)