Cloudflare has disclosed the results of a reassessment of remote Spectre attacks on the Cloudflare Workers platform, conducted during 2024 and early 2025. The research team was able to build a proof of concept that worked in the production environment and leak data from a victim Worker to an attacker Worker under the researchers’ control at a rate of up to 12 bits per second and with accuracy exceeding 99%.
The company confirms that the demonstrated attack was addressed in the production system through measures taken by the Cloudflare Workers Runtime team, and that it found no indications of active exploitation during the past three years. The results were published in a paper co-authored by Albert Pedersen, Haocheng Xiao, Sam Ainsworth, Nigel Topham, and Martin Schwarzl.
Why Does This Research Matter?
Workers relies on running untrusted JavaScript at the edge, where tens of thousands of tenants can share a single operating-system process through V8 isolates. Each Worker has a separate JavaScript heap, which improves startup time and the efficiency of hosting a large number of tenants, but it also means that an in-process arbitrary-read vulnerability could open the door to data leakage between tenants.
Spectre attacks exploit speculative execution in processors. When a processor predicts the result of a software branch and executes instructions before confirming it, the results may later be discarded, but subtle traces remain in the processor’s microarchitectural state, including the cache. An attacker can exploit differences in memory-access latency to infer bits from data they are not supposed to read.
Cloudflare launched a production defense called Dynamic Process Isolation, or DyPrIs, in 2021 to isolate scripts that appear malicious in separate processes. However, the reassessment discovered a limitation in the execution mechanism that allowed the attack to remain effective long enough to bypass the isolation.
How Did the Attack Overcome Workers’ Limitations?
The platform restricts local timers and does not allow shared memory or multithreading, so traditional measurement methods based on SharedArrayBuffer are unavailable. Instead, the researchers used a remote timer through a WebSocket connection and took advantage of signal amplification produced by cache events using the tree-based PLRU replacement policy in the L1 cache.
The team also designed two types of Spectre gadgets. The first was used to leak compressed heap pointers, including the isolate’s heap base address. The second relied on speculative type confusion to access a raw 64-bit-wide pointer, which made it possible to turn the leak into a read from an address selected by the attacker. At the time the research was conducted, V8 Sandbox had not yet been deployed in Workers, and TypedArray was among the cases that retained a raw pointer to its backing store.
To ensure reproducible measurements, the researchers created large sets of objects exceeding the cache capacity, then selected random locations in each round instead of searching for a precise eviction set for each cache line. Durable Objects were also used to keep a long-lived execution context, while WebSocket messages made it possible to reset processing-time and request limits. By using periodic pauses between execution batches, the isolate could be kept active for five hours to more than 20 hours.
To achieve adjacency between the attacker and the victim, the attacker Worker invoked the victim Worker through fetch, which in most cases caused both to run in the same process on the same edge server. This approach also made it possible to exploit periods of low load in edge locations to increase measurement stability.
What Changed in Cloudflare’s Defenses in Practice?
Cloudflare introduced several modifications rather than relying on a single measure. V8 Sandbox has become part of the protection layers and aims to reduce the presence of raw 64-bit pointers in large parts of the JavaScript heap. This makes some of the speculative-confusion gadgets used in the research more difficult to reuse, but it is not a complete remedy for Spectre attacks, as other gadgets or forms that achieve out-of-bounds memory access may emerge.
In September 2025, the company deployed in-process isolation based on Memory Protection Keys, or MPK. This technology divides memory into protection domains and switches access permissions for them at low cost, placing each isolate’s heap behind a hardware-enforced barrier. This prevents the direct reads between isolate heaps on which the attack relied, but it does not eliminate all Spectre risks; the number of protection domains is limited, and the system requires careful management of protection-key state.
Cloudflare also improved the DyPrIs mechanism to handle long-lived execution processes and I/O-intensive workloads. Waiting for an invocation to end before isolating the script is insufficient when a WebSocket connection or Durable Object can keep the invocation open for hours. The company is also investigating adding remote-timing behavior to detection signals, particularly when timer-like operations are repeatedly performed around compute-intensive sections, rather than treating the accompanying network activity as ordinary noise.
Limitations of the Result
The test was conducted against Workers controlled by Cloudflare and the researchers, and was not evidence of the compromise of actual tenants. The highest leakage rate also came at the expense of accuracy, according to the company’s clarification, and no indications of actual exploitation were observed during the previous three years. The results therefore reveal an executable attack capability in the previous isolation model and the importance of combining process isolation, hardware-enforced memory protection, and continuous behavioral detection.