Web Application Timing Attacks – or: Timing Attacks against JavaScript Applications in Browsers.

Further reading:

• The Clock is Still Ticking – Timing Attacks in the Modern Web (PDF)
• Tom van Goethem’s website
• Front-End Performance – The Dark Side