.jpg)
The researchers conducted an end-to-end experiment involving an attacker-controlled Worker and a victim Worker, with the JWT deliberately stored in the victim's memory. According to the research paper, the experiment did not involve accessing any customer information.
Cloudflare said it has already addressed the issue in its production environment by strengthening Dynamic Process Isolation (DyPrIs), integrating the V8 Sandbox and introducing Memory Protection Keys (MPK)-based in-process isolation. The company also said it found no evidence of active exploitation related to the issue during the past three years.
"We demonstrate that the production implementation of DyPrIs was insufficient," the researchers said in the paper.
Cloudflare Workers executes code belonging to multiple tenants using separate V8 isolates within the same operating-system process. Rather than relying solely on strict process-level separation, the platform uses language-level isolation to help maintain faster startup times.
According to Cloudflare, a memory-read attack within a shared Worker process could potentially enable information to leak across tenants. However, the attack requires both the attacker and victim Workers to be placed in separate V8 isolates within the same Worker process.
The researchers said the attacker must control legitimate code within its own isolate. The technique does not rely on native code execution, a V8 vulnerability or a sandbox escape.
Cloudflare Workers also limits access to local timing mechanisms by freezing or reducing the precision of timers during CPU execution. Worker scripts do not have access to shared memory or multithreading. However, the researchers discovered that WebSocket communications could act as a remote timing channel.
They also found that Durable Objects could keep a Worker isolate running continuously for periods ranging from five hours to more than 20 hours. Under DyPrIs, suspicious scripts are moved into a separate process after an invocation ends. The researchers found that long-running Durable Object invocations could remain active before this isolation mechanism was triggered.
Another weakness involved WebSocket-intensive input/output activity. The researchers observed that such activity increased instruction translation lookaside buffer (iTLB) activity, weakening the normalized branch-misprediction signal monitored by DyPrIs and pushing it below the mechanism's detection threshold.
Cloudflare characterized the problem as a limitation in how DyPrIs was implemented. The research paper, however, argued that the weaknesses represented more fundamental limitations of the detection methodology rather than simple implementation errors. The researchers recommended monitoring for such activity during execution and using signals that cannot be suppressed through I/O activity.
The researchers conducted their production testing on Linux servers powered by AMD EPYC Zen 2 and Zen 3 processors. Measurements were intentionally performed at night, when CPU utilization was between 10% and 25%, to determine the highest achievable leakage rate.
According to the paper, heavier system workloads reduced the amount of data that could be leaked, although the attack remained possible at slower speeds under greater CPU load.
The study recorded a peak leakage rate of 12 bits per second with 99.16% accuracy. By comparison, the earlier attack achieved approximately 2 bits per minute.
The latest disclosure arrives nearly five years after Cloudflare and Graz University of Technology (TU Graz) published research detailing a remote Spectre attack against Workers. That earlier work demonstrated a leakage rate of 120 bits per hour and introduced DyPrIs as a defense mechanism.
The 2021 research reported a false-positive rate of 0.61% and concluded that DyPrIs offered, statistically, security guarantees comparable to strict process isolation against the Spectre attacks evaluated at that time.
Cloudflare subsequently outlined additional security hardening measures for Workers in September 2025. The company's mitigations include:
Enhanced DyPrIs: Improvements designed to strengthen the detection capabilities of the existing isolation mechanism.
V8 Sandbox: A security layer designed to restrict transient access to 64-bit pointers.
MPK-based in-process isolation: Worker heaps are placed behind hardware-enforced Memory Protection Keys. Cloudflare said modern x64 systems provide approximately 12 keys that can be used for this purpose. Its architecture combines MPK with the V8 Sandbox and a rotating memory layout to prevent neighboring sandboxes from being assigned the same protection key.
Cloudflare's September 2025 documentation noted that randomly assigning MPK keys would block roughly 92% of cross-isolate access attempts because two isolates could receive the same key. The company said its stricter rotating memory layout eliminates that remaining gap within the threat model covered by the in-sandbox protections.
.jpg "Microsoft Copilot Flaws Could Expose User Data With One Click")
.jpg)
