Cloudflare’s Own Researchers Pulled Off a Remote Spectre Attack on Workers Before Hardening It

Cloudflare spent years arguing that its Workers platform could hold off Spectre-style attacks. Its own security researchers have now shown that, for a while, it couldn’t, at least not completely.

In a blog post on Wednesday, Martin Schwarzl and Albert Pedersen described an end-to-end remote Spectre attack they ran against the Workers production environment, using Workers they controlled. The attack leaked data from a co-located victim Worker “reliably leaking up to 12 bit/s with a 99% accuracy,” they wrote. The secret they planted and extracted was a JWT token. The company also published an accompanying paper, written with Haocheng Xiao, Sam Ainsworth and Nigel Topham of the University of Edinburgh, which says the result goes “from 2 bit/min to up to 12 bit/s” compared with the earlier attack Cloudflare assessed in 2021.

Cloudflare said the attack is already mitigated in production and that it “did not find any indicators of active exploitation over the last three years.” The research itself dates to 2024 and early 2025.

Why Workers is exposed in the first place

Workers keeps cold starts fast by running tens of thousands of tenants inside one operating-system process, each in its own V8 isolate with a separate JavaScript heap. That makes in-process Spectre the hard case. Cloudflare’s defenses froze local timers, banned shared memory and multithreading, and relied on Dynamic Process Isolation (DyPrIs), which watches hardware performance counters and moves suspicious scripts into their own processes.

The researchers got around each of those. A WebSocket connection to an outside server stood in for the missing high-resolution clock, and a cache trick based on the L1 cache’s tree-based PLRU replacement policy amplified a few nanoseconds of difference into something a noisy network timer could see. Co-location was “quite trivial,” the post says: a fetch from the attacker script to the victim usually caused the scheduler to start the victim in the same process.

DyPrIs missed it for two reasons. It only isolated a script after its invocation finished, and a Durable Object kept alive over WebSocket could hold one invocation open for hours. The WebSocket traffic also inflated iTLB activity, which pushed the attack’s normalized misprediction ratio below the detection threshold.

What changed

Cloudflare integrated the V8 Sandbox, which removes the raw 64-bit pointers the type-confusion gadget relied on, and in September 2025 deployed in-process isolation using Memory Protection Keys, putting each isolate’s heap behind a hardware-enforced boundary. It also reworked DyPrIs to treat long-lived and I/O-heavy executions as security cases rather than waiting for scripts to finish.

The company does not call any of this a complete fix. “The V8 sandbox is not a complete Spectre mitigation,” the post says, and MPK has limits, including a finite number of hardware domains. Cloudflare said it is now looking at whether remote timing patterns could become another detection signal for DyPrIs.