[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-cloudflare-found-a-spectre-leak-in-workers-then-patched-it":10,"sections":35},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":24,"tags":25,"sources":30,"feedback":34,"feedback_at":22,"cost_usd":34,"total_tokens":34},5733,"cloudflare-found-a-spectre-leak-in-workers-then-patched-it","Cloudflare Found a Spectre Leak in Workers, Then Patched It","A 2024-2025 study found a way to leak 12 bits per second from Cloudflare Workers via Spectre, prompting a fix to its process-isolation defenses.","Cloudflare just published research showing its Workers platform was still leakable via a Spectre side-channel attack, years after it thought it had shut the door.\n\nCloudflare Workers runs untrusted JavaScript from tens of thousands of tenants inside shared operating-system processes, leaning on V8's isolate model instead of full process isolation to keep things fast. In 2021, Cloudflare tested Spectre attacks against that setup and responded with a defense called Dynamic Process Isolation, which flags suspicious-looking scripts and moves them into their own process. Newer techniques for stabilizing Spectre attacks led Cloudflare to rerun the experiment in 2024 and early 2025, and this time researchers found a gap in that defense. Using two custom Spectre gadgets - one leaking heap pointers, another exploiting a type-confusion bug to read arbitrary 64-bit addresses - they pulled data across tenant boundaries at up to 12 bit\u002Fs with 99% accuracy, even though Workers freezes timers and blocks shared memory specifically to make this kind of attack harder.\n\n12 bit\u002Fs sounds trivial, but Spectre leaks don't need speed, they need reliability, and 99% accuracy against a production system hardened specifically against this attack class is the real story. It's a reminder that \"efficient multi-tenant JavaScript sandbox\" and \"provably immune to microarchitectural side channels\" are still in tension more than five years after Spectre's disclosure. Cloudflare says it found no evidence of exploitation and has since added V8 Sandbox protections and tighter in-process isolation.\n\nSpectre never really left. It just keeps finding gaps between what CPUs promise to isolate and what they actually isolate at the silicon level.","[\"spectre\",\"cloudflare workers\",\"side-channel attacks\",\"security research\"]","2026-08-19T16:00:28.000Z","2026-08-19T16:58:44.489Z","2026-08-19T16:58:56.210Z","published",null,[],"security",[26,27,28,29],"spectre","cloudflare workers","side-channel attacks","security research",[31],{"name":32,"url":33},"Cloudflare Blog","https:\u002F\u002Fblog.cloudflare.com\u002Frevisiting-spectre-attacks-on-workers\u002F",0,{"sections":36},[37,42,45,50,55,60,65,70,75,80,85,90,95,100],{"name":38,"slug":39,"count":40,"latest_published_at":41},"AI","ai",3293,"2026-08-20T04:00:00.000Z",{"name":43,"slug":24,"count":44,"latest_published_at":41},"Security",435,{"name":46,"slug":47,"count":48,"latest_published_at":49},"Policy","policy",210,"2026-08-19T09:32:27.000Z",{"name":51,"slug":52,"count":53,"latest_published_at":54},"Deals","deals",179,"2026-06-29T20:02:07.000Z",{"name":56,"slug":57,"count":58,"latest_published_at":59},"Hardware","hardware",140,"2026-08-19T18:25:42.000Z",{"name":61,"slug":62,"count":63,"latest_published_at":64},"Consumer Tech","consumer-tech",95,"2026-08-18T16:05:00.000Z",{"name":66,"slug":67,"count":68,"latest_published_at":69},"Science","science",90,"2026-08-19T18:41:02.000Z",{"name":71,"slug":72,"count":73,"latest_published_at":74},"Software","software",73,"2026-08-18T07:51:50.000Z",{"name":76,"slug":77,"count":78,"latest_published_at":79},"Dev Tools","dev-tools",69,"2026-08-18T04:00:00.000Z",{"name":81,"slug":82,"count":83,"latest_published_at":84},"Startups","startups",47,"2026-08-19T19:13:46.000Z",{"name":86,"slug":87,"count":88,"latest_published_at":89},"Gaming","gaming",41,"2026-07-09T04:00:00.000Z",{"name":91,"slug":92,"count":93,"latest_published_at":94},"General","general",33,"2026-08-18T22:18:13.000Z",{"name":96,"slug":97,"count":98,"latest_published_at":99},"Reviews","reviews",20,"2026-06-24T12:00:01.000Z",{"name":101,"slug":102,"count":103,"latest_published_at":104},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]