Cloudflare has published new research showing that its Dynamic Process Isolation (DyPrIs) defense, deployed in 2021 to contain remote Spectre attacks on Cloudflare Workers, contained a limitation that allowed a proof-of-concept exploit to leak data at up to 12 bits per second with 99 percent accuracy on the production network. The study, conducted throughout 2024 and early 2025 with researchers from TU Graz, reassessed the threat after newer Spectre stabilization techniques emerged in the academic literature.
The attack chain required an external adversary to overcome production noise — shared hardware activity, interrupts, context switches, and coarse-grained timers — before achieving reliable co-location with a target Worker. Cloudflare says it has since hardened DyPrIs, integrated the V8 Sandbox, and added an in-process isolation mechanism to further reduce the risk of memory disclosure. The company reports no indicators of active exploitation over the past three years.
What's new
- Remote Spectre proof-of-concept achieved 12 bit/s leakage at 99% accuracy on production Workers infrastructure.
- Root cause: a limitation in the original DyPrIs implementation that allowed malicious scripts to remain co-located with victims.
- Countermeasures now deployed: improved DyPrIs logic, V8 Sandbox integration, and an additional in-process isolation layer.
- Research paper co-authored by Albert Pedersen, Haocheng Xiao, Sam Ainsworth, Nigel Topham, and Martin Schwarzl.
Context
Cloudflare Workers runs untrusted JavaScript from tens of thousands of tenants inside a single OS process using V8 isolates, a design that keeps startup latency low and density high. Since Spectre-class attacks exploit speculative execution side channels shared across security boundaries, any multi-tenant environment on shared silicon faces theoretical risk. The 2021 DyPrIs system automatically detected suspicious scripts — those exhibiting pathological performance patterns intended to amplify microarchitectural signals — and moved them into dedicated processes.
The new research demonstrates that the original detection logic could be evaded, allowing an attacker to maintain co-location long enough to build a reliable remote timer and extract data. The V8 Sandbox, which restricts memory access within the isolate, and the new in-process isolation mechanism add defense-in-depth even if process-level isolation is bypassed.
Why it matters
Serverless platforms that pack many tenants into one process rely on language-level isolation as a primary security boundary. This work shows that even sophisticated heuristic defenses can have blind spots when new attack primitives appear. For customers, the takeaway is that Cloudflare's layered approach — heuristic process isolation, compiler-level sandboxing, and OS-level containment — now addresses the specific gap identified. Other edge compute providers using similar isolate-based architectures face comparable threat models.
Our take
The 12 bit/s figure sounds modest, but it proves the theoretical risk is exploitable under real-world noise. Cloudflare's decision to publish the full attack details and the paper alongside the fix is the right call — it lets the broader serverless ecosystem stress-test their own isolation assumptions.
