- today → Cloudflare blog — paper describing the reassessment published today
- last three years → Cloudflare blog — no active exploitation indicators over the last three years
- January 2018 → Google Security Blog — Spectre publicly disclosed in January 2018
- March 2021 → Google Security Blog — Röttger and Janc published a portable Spectre proof-of-concept in March 2021
- 2024 and early 2025 → Cloudflare blog — research period covered by the paper
Albert Pedersen, Haocheng Xiao, Sam Ainsworth, Nigel Topham, and Martin Schwarzl co-authored a paper, published today Cloudflare blog, that shows a remote Spectre attack can leak memory from Cloudflare Workers at 12 bits per second with 99 percent accuracy. Cloudflare said the weakness was already mitigated by its Workers Runtime team, and it found no signs of exploitation over the last three years.
The number sounds small until you remember what it means: a script running on one customer’s edge function quietly reading another customer’s secrets.
Albert Pedersen described the leak plainly: “We managed to demonstrate a remote Spectre attack reliably leaking up to 12 bit/s with a 99% accuracy in the production environment of Cloudflare Workers.” Cloudflare blog
What the paper reopens is a question the industry thought it had paused — can shared-process isolation ever fully outrun speculative execution?
Spectre first broke the promise that browser-style sandboxes could keep tenants apart when it was disclosed in January 2018 Google Security Blog. The flaw rides on speculative execution: a CPU guesses a branch, races ahead, then discards the work — but leaves footprints in the cache that a clever script can read and decode, one bit at a time.
The team behind V8, Chrome’s JavaScript engine, had already concluded that such attacks could not be reliably fixed in software and called for process-based isolation instead Google Security Blog. Cloudflare’s own answer, shipped after an earlier assessment, was Dynamic Process Isolation — DyPrIs — which spots malicious-looking scripts and moves them into separate processes.
Why a shared process is both the speed and the risk
The team borrowed a trick first shown by Stephen Röttger and Artur Janc in a March 2021 Google post Google Security Blog: amplify a single cache event so that even a noisy remote timer can tell a hit from a miss. Pair that with a co-location trick — calling a victim Worker from an attacker Worker usually lands both in the same process — and a stable side channel opens.
DyPrIs worked until it didn’t. The researchers found a gap in how it decided which scripts to isolate and turned that gap into a reliable leak. The deeper tension is structural. V8 isolates let many tenants share one operating-system process, which is exactly why Workers starts in milliseconds and runs cheaply. Full process isolation would be safer, but slower and far more expensive. Cloudflare is trying to keep both.
What Cloudflare changed, and what stays open
Cloudflare said it has since improved DyPrIs and added the V8 Sandbox plus an in-process isolation mechanism to shrink the chance of memory disclosure, based on research the team completed in 2024 and early 2025 Cloudflare blog. The company stresses the demonstrated attack is already blocked in production.
Cloudflare’s isolation work reaches further than Spectre. Teams building on the edge can see how others sandbox untrusted code with Cloudflare’s Dynamic Workers zBrandco.
The ghost is still in the machine. The cheapest, fastest way to run untrusted code at the edge is still the design attackers keep learning to whisper to.
