Source
A revisit of remote Spectre attacks on Cloudflare Workers
Cloudflare research demonstrated that remote Spectre attacks could reliably leak data between tenants in its Workers production environment. This exposed limitations in the Dynamic Process Isolation (DyPrIs) defense, which Cloudflare has since improved.
Why it matters
This vulnerability potentially allowed attackers to steal sensitive information from other users sharing the same server process. Fixing it ensures that customer data remains isolated and protected from side-channel memory leaks.
The details
- The attack leaked up to 12 bit/s with over 99% accuracy in production.
- Memory Protection Keys (MPK) provide hardware-enforced isolation for isolate heaps.
- Cloudflare found no indicators of active exploitation over the last three years.
Show entities and relationshipsHide entities and relationships
In this article
Technologies
Topics
Companies
Organizations
Key connections
Cloudflare owns Dynamic Process Isolation (DyPrIs)
Dynamic Process Isolation (DyPrIs) is a security defense mechanism created by Cloudflare.
Cloudflare owns Durable Objects
Durable Objects is a real-time coordination and storage product developed by Cloudflare.
Cloudflare Workers uses Dynamic Process Isolation (DyPrIs)
Cloudflare Workers uses Dynamic Process Isolation to isolate suspicious scripts into separate processes.
Cloudflare Workers uses Durable Objects
Cloudflare Workers utilizes Durable Objects for persistent state and real-time coordination.
Cloudflare Workers uses V8
Cloudflare Workers uses V8 isolates for lightweight multi-tenant JavaScript execution.
Albert Pedersen works at Cloudflare
Albert Pedersen is a security researcher at Cloudflare who co-authored the Spectre paper.
Show 14 more connectionsShow fewer connections
Martin Schwarzl works at Cloudflare
Martin Schwarzl is a security researcher at Cloudflare who co-authored the Spectre paper.
Haocheng Xiao works at University of Edinburgh
Haocheng Xiao is a researcher at the University of Edinburgh who contributed to the Spectre research.
Sam Ainsworth works at University of Edinburgh
Sam Ainsworth is an academic supervisor at the University of Edinburgh supervising Spectre research.
Nigel Topham works at University of Edinburgh
Nigel Topham is an academic supervisor at the University of Edinburgh supervising Spectre research.
Cloudflare is a partner of University of Edinburgh
Cloudflare collaborated with University of Edinburgh researchers to investigate remote Spectre attacks.
Cloudflare Workers is related to Spectre
Cloudflare Workers researched and deployed mitigations against in-process Spectre speculative execution attacks.
Cloudflare Workers uses Memory Protection Keys (MPK)
Cloudflare Workers deployed Memory Protection Keys (MPK) in September 2025 for hardware-assisted in-process isolation.
Cloudflare Workers uses Linux Namespaces
Cloudflare Workers runtime uses Linux namespaces as part of its two-layered sandbox defense.
Cloudflare Workers uses Seccomp
Cloudflare Workers runtime uses seccomp filters as part of its two-layered sandbox defense.
Cloudflare Workers uses Cap'n Proto
Cloudflare Workers runtime utilizes Cap'n Proto RPC across its isolation layers.
Durable Objects uses WebSocket
Durable Objects uses persistent WebSocket connections for real-time client coordination.
Cloudflare Workers is related to Tree-Based PLRU
The remote Spectre attack evaluated against Cloudflare Workers exploited tree-based PLRU cache replacement for signal amplification.
Cloudflare Workers uses Edge Computing
Cloudflare Workers executes untrusted JavaScript on the edge across global edge servers
Cloudflare owns Cloudflare Workers
Cloudflare owns and operates the Workers serverless platform.
Related events
Cloudflare Details Remote Spectre Research on Workers and Implements MPK Hardware Isolation
Get the weekly recap
The stories like this one, picked and explained — once a week, straight to your inbox.