Researchers Demonstrate Faster Spectre Data Leakage Across Cloudflare Workers

Security researchers have disclosed a remote Spectre side-channel attack that extracted a JSON Web Token (JWT) from a co-located Cloudflare Worker at a rate of up to 12 bits per second. The result is substantially faster than a 2021 demonstration, which achieved approximately 2 bits per minute.

The researchers conducted an end-to-end test using one Worker under their control as the attacker and another as the victim. They deliberately stored the JWT in the victim’s memory and reported that the experiment did not involve customer data. The attack required both Workers to run in separate V8 isolates within the same operating-system process. It did not require native code execution, a V8 vulnerability, or a sandbox escape.

Isolation and timing challenges

Cloudflare Workers traditionally used V8 isolates to allow multiple tenants to share a process while reducing startup overhead. This model depends on language-level separation rather than complete process isolation. Spectre techniques can exploit processor speculation to infer information across those boundaries.

Because Worker scripts have restricted or low-resolution local timers, the researchers used WebSocket activity as a remote timing signal. They also found that Durable Objects could keep an isolate active for several hours. That persistence delayed Cloudflare’s Dynamic Process Isolation (DyPrIs) response, which is designed to move suspicious workloads into a separate process after an invocation ends.

In addition, WebSocket-heavy input/output increased instruction translation lookaside buffer activity. This weakened the branch-misprediction signal used by DyPrIs and allowed the attack to remain below its detection threshold. The researchers characterized these issues as limitations of execution-time detection, while Cloudflare described them as shortcomings in the production implementation.

The test was performed on Linux systems equipped with AMD EPYC Zen 2 and Zen 3 processors. Leakage reached 99.16% accuracy under relatively low system load, although heavier workloads reduced the rate rather than eliminating the attack.

Cloudflare’s response

Cloudflare said it has strengthened Workers in production and found no evidence of exploitation during the preceding three years. The company cited improved DyPrIs detection, integration of the V8 Sandbox, and hardware-assisted in-process isolation using Memory Protection Keys (MPK).

The updated design combines MPK with sandbox restrictions and rotating memory layouts to reduce the chance that neighboring isolates can access one another’s protected memory. The measures build on additional Workers hardening Cloudflare described in 2025.