A New Spectre Attack Leaking 12 Bits a Second — and How Cloudflare Workers Sealed It With Hardware!

Hi everyone, it's Shii-chan! Today's story is a little thrilling, but really important. Turns out the famous CPU vulnerability Spectre has been baring its teeth at today's cloud platforms, but don't worry, the fix is already in place, so let's dig in！

Cloudflare Blog blog.cloudflare.com

What was announced?

Cloudflare's Blog published research, done jointly with the University of Edinburgh, that re-evaluated remote Spectre attacks against the Workers platform across 2024 and 2025. It's a meaty technical write-up. Cloudflare had already done a similar assessment back in 2021, but the techniques for reliably pulling off Spectre attacks kept advancing, so the team asked whether the current defenses were really enough and dug back in.

The story so far

Back in 2021, reliably pulling off a remote side-channel attack like Spectre was thought to be hard. Workers is multi-tenant — code from many different customers can end up sharing a process as separate isolates (V8's lightweight execution environment) — so the theoretical risk of peeking into a neighboring isolate's memory existed, but the techniques to actually extract data reliably hadn't caught up yet.

What changes

This re-evaluation proved that an attacker really can leak secrets this way. But the key point is that Cloudflare has already hardened production in response to these findings. Specifically, it rolled out the V8 Sandbox and deployed Memory Protection Keys (MPK), hardware-enforced isolation between isolates, to production in September 2025. So if you're using Workers today, you don't need to change any settings, but this is a rare, concrete look at how a multi-tenant execution platform actually gets defended.

Dive Deep

The attack the research team assembled breaks down into four steps.

1. Two new Spectre gadgets

• The first leaks a compressed heap pointer
• The second exploits speculative type confusion, mistraining a branch like obj instanceof ObjP to abuse the 64-bit raw pointer inside a TypedArray, letting the attacker read an arbitrary address from a memory layout they control

2. Amplifying the signal to read it remotely

The team abused a quirk of the L1 cache's tree-based PLRU (pseudo-LRU) replacement policy to massively amplify what's normally a tiny timing difference between memory accesses. On top of that, a remote timer built from timestamps sent by an external server over a WebSocket connection gave them sub-millisecond resolution for telling cache hits from misses.

3. Sharing a process with the victim

Calling fetch() against the target script can get an isolate scheduled into the same process as the victim, so the team deliberately engineered this co-location. They even checked the /cdn-cgi/trace endpoint to confirm they'd landed in the right environment.

4. Overstaying with Durable Objects

Workers normally caps a single invocation at 30 seconds of CPU time and 1,000 subrequests. But by using Durable Objects and resetting that counter every time a WebSocket message came in, the team kept an isolate alive for 5 to 20+ hours. By behaving like an ordinary, I/O-heavy Worker, they also managed to slip under the threshold of Cloudflare's abuse-detection system, DyPrIs.

Putting it all together, the team demonstrated leaking secrets like JWT tokens bit by bit, at up to 12 bits per second with over 99% accuracy (they even fully recovered a leading byte, e (0b01100101)).

Cloudflare's response was just as concrete:

• V8 Sandbox: strips raw 64-bit pointers out of the JavaScript heap entirely and changes the TypedArray backing-store structure, so the gadgets found here no longer work
• Isolation via Memory Protection Keys (MPK): rolled out to production in September 2025. Each isolate's heap now sits behind a hardware-enforced access boundary, and the hardware itself rejects any memory access made with the wrong key
• Improved DyPrIs: long-running and I/O-heavy workloads are now treated as first-class security cases, with in-flight detection added to catch anomalies while an invocation is still running

Cloudflare notes the attack is already mitigated in production, and it has seen no signs of active exploitation over the past three years.

Wrap-up

• Cloudflare, working with the University of Edinburgh, re-evaluated remote Spectre attacks against Workers across 2024-2025
• By combining new Spectre gadgets, cache-based amplification, a remote timer, and long-lived co-location via Durable Objects, the team demonstrated leaking secrets at up to 12 bits per second with over 99% accuracy
• In response, Cloudflare stripped raw pointers via the V8 Sandbox and deployed hardware-enforced isolation with Memory Protection Keys to production in September 2025
• The abuse-detection system DyPrIs was also improved to no longer miss long-running, high-I/O workloads
• There's no evidence of real-world exploitation, and Cloudflare's Bug Bounty program keeps accepting reports

If you care about the security design of multi-tenant serverless platforms, or want a real-world example of a Spectre-style side-channel attack, this one is packed with implementation-level cat-and-mouse — a great read！