Researchers extracted a JSON Web Token from a co-located Cloudflare Worker in a live production test, pulling data at up to 12 bits per second. That is roughly 360 times faster than the remote Spectre attack demonstrated in 2021. Both Workers belonged to the researchers, and no customer data was touched.
The platform hosts many tenants as separate V8 isolates within a single OS process, choosing language-level isolation over process separation to keep cold starts fast. The attack needs the two Workers to sit in separate isolates of the same process, but requires no V8 exploit or sandbox escape. The researchers used WebSocket traffic as a remote timing source and Durable Objects to keep a single isolate alive for five to more than 20 hours, defeating Cloudflare’s Dynamic Process Isolation, which moves suspicious scripts only after an invocation finishes.
Leakage hit 12 bits per second at 99.16 percent accuracy on AMD EPYC Zen 2 and Zen 3 servers, with rates measured at night when CPU load was low. Cloudflare said it has mitigated the issue in production by hardening DyPrIs, integrating the V8 Sandbox, and deploying Memory Protection Keys-based in-process isolation, and found no indicators of exploitation over the past three years.
The researchers argue the weaknesses point to fundamental limits of detection-based isolation: robust defense should happen during execution and use a signal that input/output activity cannot suppress. For platform teams running multi-tenant serverless runtimes, the work is a reminder that speculative execution attacks still warrant hardware-level isolation guarantees.
