Seems a little far-fetched and overly complicated for carrying out a practical attack.

Yes, but at least it would work for practically everything, and it seems most effective to start at the source if you're bribing big companies anyway. If you bribe Microsoft you'll only get the IE (and possibly Windows) users, and privacy-minded individuals will likely be avoiding those already.

Also it's pretty much impossible to patch and protect against, even if you know the exploit exists.

You'd still need some kind of software support to trigger the exploit. At which point you may as well go with a software-only attack.

Naah, if it's simply a few added instructions I agree with you.

But let's think in a wider scope (disclaimer: this is not my idea, I remember reading about it a long time ago): what if a certain cryptographic "magic code" at the beginning of a memory page would trigger the execution of arbitrary code embedded in that page?

Such a thing could be triggered over the network, wireless through bluetooth/wifi, or by specially crafted images on a webpage, or whatever creative technique you can think of. It'd effectively give the govt instant root access to any device with the affected CPUs.

Stuff like this would be easy to hide in the guise of "Hardware DRM."

Yes, I guess on-processor DRM and any kind of virtualisation (will the real hypervisor please stand up?) are prime suspects for this kind of thing. But they are also the most obvious, it could be cramped into everything.

It'd be mighty interesting to tear apart / scan / reverse engineer some modern CPUs like they did with the 6502. Then again, these beasts are so complex that's similar to looking for a needle in a galaxy-sized haystack.