In 2021, Cloudflare assessed remote Spectre attacks against its Workers platform and deployed Dynamic Process Isolation (Dy Pr Is) as a defense. Newer Spectre stabilization techniques prompted a reassessment in 2024-2025. Researchers built an updated proof-of-concept on the production environment to evaluate risk under real workloads.

The team identified a limitation in Dy Pr Is and demonstrated a remote Spectre attack leaking up to 12 bits per second with 99% accuracy. Attackers must overcome obstacles like shared hardware activity, interrupts, context switches, and coarse timers. The attack requires co-location, a reliable remote timer, and stable Spectre gadgets for 64-bit out-of-bounds access.

Following the research, Cloudflare enhanced Dy Pr Is, integrated the V8 Sandbox, and added in-process isolation. The attack is already mitigated in production, with no evidence of active exploitation over three years. Cloudflare Workers uses V8 isolates for language-level isolation, allowing tens of thousands of tenants to share OS processes while maintaining separate JavaScript heaps.

The paper, co-authored by Albert Pedersen, Haocheng Xiao, Sam Ainsworth, Nigel Topham, and Martin Schwarzl, details these findings and the speculative execution vulnerabilities exploited.