A revisit of remote Spectre attacks on Cloudflare Workers

Cloudflare researchers extracted secrets across tenant boundaries in production Workers at 12 bits per second with 99% accuracy—100 times faster than previous remote Spectre attacks. 👇

Cloudflare Workers packs thousands of untrusted JavaScript isolates into single OS processes to avoid VM overhead. While efficient, a speculative execution flaw in CPU hardware can allow one isolate to speculatively read raw memory from a neighboring isolate in the same process.

To test if modern stabilization tricks could bypass their production defenses, Cloudflare built a proof-of-concept that chained an unexpected runtime behavior with a cache-amplification trick to defeat process timers and anomaly detection.

The attack starts with co-location. Making a standard `fetch` call from an attacker Worker to a target victim Worker tricks Cloudflare's scheduler into placing both isolates inside the exact same OS process.

To keep the target isolate alive without hitting execution limits, the attacker opens a persistent WebSocket using Durable Objects. Because incoming WebSocket messages reset CPU limits, the attacker can maintain a single execution context for over 20 hours without resetting the process state.

Cloudflare disables high-resolution local timers and multithreading, so measuring nanosecond cache differences over a network requires signal amplification. The attacker triggers a speculative type-confusion gadget in V8 that abuses raw 64-bit pointers in `TypedArray` objects to speculatively read target memory addresses.

To turn nanosecond cache hits into network-measurable signals, the attacker exploits L1 tree-based PLRU cache replacement. Traversing specific node patterns amplifies a single cache hit into thousands of repeated L1 hits, making the timing delta visible even through a noisy remote WebSocket timer.

To clear the cache between probes without expensive eviction set searches, the attacker relies on the pigeonhole principle. Allocating a memory pool larger than the CPU cache and picking fresh random object pairs each round guarantees the target metadata is evicted before the next run.

Cloudflare's original defense mechanism, DyPrIs, missed the attack for two reasons. It only evaluated scripts after they finished executing—which the WebSocket keep-alives delayed indefinitely—and the heavy network I/O inflated instruction TLB accesses, artificially lowering the measured branch misprediction ratio below the alert threshold.

The updated attack boosted remote leakage rates from the previous benchmark of 120 bits per hour up to 12 bits per second with 99% accuracy in production.

Cloudflare mitigated the vulnerability across three layers:

V8 Sandbox: Removes raw 64-bit pointers from the JS heap so typed arrays no longer expose direct memory addresses.

Hardware-assisted MPK: Uses Intel Memory Protection Keys to enforce hardware page boundaries between isolate heaps inside the same process.

Updated DyPrIs: Monitors branch behavior continuously during execution rather than waiting for script completion, treating high-volume timer I/O as part of the threat signal.