Cloudflare Revisits Spectre on Workers: 12 bit/s Leak in Production, DyPrIs Gap Found

Cloudflare has published a paper detailing a reassessment of remote Spectre attacks against its Workers platform. The research, conducted in 2024 and early 2025, uncovered a limitation in the existing Dynamic Process Isolation (DyPrIs) defense and demonstrated a reliable remote Spectre attack in the production environment, leaking up to 12 bit/s with 99% accuracy. The attack is already mitigated in production, and no active exploitation was found over the last three years.

Workers Security Model and Spectre

Cloudflare Workers runs untrusted JavaScript on the edge using V8 isolates, allowing tens of thousands of tenants to share a single OS process. This design is efficient but means a single arbitrary read vulnerability can lead to cross-tenant leakage. Spectre, which exploits speculative execution, is particularly hard to mitigate in this model. The CPU speculatively executes instructions based on branch predictions, and even when rolled back, traces remain in microarchitectural state like caches, enabling side-channel attacks.

Attack Primitives

The attack required solving several challenges: co-location with a victim, a reliable remote timer, and a Spectre gadget for transient out-of-bounds access. Cloudflare restricts timers—Date.now() and performance.now() are frozen during CPU-only execution, and there's no shared memory or multithreading. The researchers used a WebSocket connection to an external server as a remote timer, achieving sub-ms resolutions.

The Spectre gadget leverages a speculative type confusion to transiently read an attacker-controlled 64-bit pointer. By mistraining branch prediction, they could leak bits from arbitrary memory addresses. To amplify the signal, they exploited the tree-based PLRU cache-replacement policy in L1 caches, making a single cache hit/miss distinguishable even with a noisy remote timer.

Impact and Mitigations

The research revealed a limitation in DyPrIs, which isolates malicious-looking scripts into separate processes. The improved defenses now include the V8 Sandbox and an in-process isolation mechanism, further reducing the risk of memory disclosure attacks. The paper is co-authored by Albert Pedersen, Haocheng Xiao, Sam Ainsworth, Nigel Topham, and Martin Schwarzl.

This work underscores the evolving nature of side-channel attacks and the need for continuous reassessment of security defenses in multi-tenant environments.