A revisit of remote Spectre attacks on Cloudflare Workers

In 2024 and 2025 Cloudflare reassessed remote Spectre attacks on its Workers infrastructure by building an updated proof-of-concept on the production system. This effort aimed to evaluate whether newer Spectre techniques could threaten the existing Dynamic Process Isolation (DyPrIs) defense. The researchers demonstrated a remote Spectre attack that reliably leaked up to 12 bit/s with 99 % accuracy. The demonstration was performed under real-world workloads on the edge platform.

To succeed, an external attacker must overcome activity on shared hardware resources, interrupts, context switches and the coarse-grained timers that Cloudflare deliberately restricts. The attack also requires a reliable remote timer and guaranteed co-location between the attacker’s and victim’s Workers. Cloudflare’s runtime limits timers during CPU-only execution, removing high-resolution clocks such as Date.now() and performance.now(). These constraints raise the cost of the attack, as the attacker must devise alternative timing channels and secure placement on the same physical core.

After identifying a limitation in DyPrIs, Cloudflare improved the isolation mechanism, integrated the V8 Sandbox and added an in-process isolation layer. The updated defenses aim to reduce the risk of memory disclosure from transient execution attacks. The paper describing the work was co-authored by Albert Pedersen, Haocheng Xiao, Sam Ainsworth, Nigel Topham and Martin Schwarzl. Cloudflare states that the presented attack is already mitigated in the production system due to the applied countermeasures.

No indicators of active exploitation have been observed over the last three years, according to the company's monitoring. The reassessment shows that even with layered defenses, speculative execution remains a concern for multi-tenant edge runtimes. Engineers should continue to assess timer restrictions, co-location guarantees and the effectiveness of process-level isolation when running untrusted code at the edge. If an attacker could bypass the timer restrictions or achieve stable co-location, the demonstrated leakage rate could become a practical threat.