Cloudflare Workers Spectre Exploit Stole Auth Tokens 360× Faster Than Prior Attack

Researchers proved they could steal a live authentication token from Cloudflare's production serverless infrastructure using a Spectre-class side-channel attack that ran 360 times faster than the known technique — and evaded detection entirely by exploiting a feature that Cloudflare built for legitimate coordination tasks. Cloudflare published the full findings on August 19, 2026, alongside a companion academic paper , after confirming that three layers of mitigation were already deployed.

The attack achieved reliable JSON Web Token (JWT) exfiltration at up to 12 bits per second with greater than 99% accuracy in Cloudflare's live production environment — not in a lab, and not against a mock setup. A JWT is the credential many web applications use to prove a user is logged in; stealing one silently means stealing that session. At 12 bits per second, a token of a few hundred bits can be drained in well under a minute, with no anomaly visible at the application layer, no network exploit, and no vulnerability in the victim's code.

Cloudflare said it found no evidence that anyone used this technique outside the research. But the research itself, conducted through 2024 and into early 2025 by engineers from Cloudflare, Graz University of Technology, and the University of Edinburgh, demonstrates that Spectre attacks in cloud environments are not merely theoretical — they improve, methodically, as researchers discover better techniques.

Spectre, disclosed publicly in January 2018 , is not a software bug. It exploits the way modern CPUs perform speculative execution — pre-computing results along what the processor predicts will be the code path before it knows whether that path is correct. When the prediction is wrong, the CPU discards the architectural results but leaves microarchitectural traces in its caches. An attacker who can measure how long subsequent memory accesses take — cache hit (fast) or cache miss (slow) — can infer what data the CPU speculatively touched, one bit at a time.

In 2021, Cloudflare and TU Graz researchers published the first proof-of-concept Spectre attack against Cloudflare Workers — demonstrating leakage of approximately 120 bits per hour. Cloudflare responded by deploying Dynamic Process Isolation (DyPrIs), which monitors hardware performance counters — specifically abnormal branch misprediction rates — and moves suspect Worker scripts into their own isolated operating-system processes before they can cause harm.

The 2026 research revisited that assumption. The team combined three independently significant advances to produce a proof-of-concept that leaks at 12 bits per second — roughly a 360-fold improvement over 2021 — without any new hardware vulnerability. Every gain came from algorithmic improvements in how the attack is structured in JavaScript.

The attack's core is a speculative type confusion exploiting a specific feature of how V8, Google's JavaScript engine, handled typed arrays before the V8 Sandbox was deployed. When a Worker checks whether a JavaScript object is of a particular type, the CPU's branch predictor speculatively assumes the most likely outcome and begins executing code for that branch. Researchers constructed a "fake" object whose type field sits on a different CPU cache line than the pointer field they wanted to read. By evicting the type field from cache — opening a speculative execution window — while keeping the pointer field cached, the CPU speculatively followed an attacker-controlled 64-bit raw pointer and read an arbitrary memory address. One bit of what it found was then encoded into the cache state using a probe array. That probe array was read back through timing to recover the bit. Details of the speculative type confusion gadget are published in the companion paper.

At the time of the research, TypedArray backing stores in V8 still held raw 64-bit pointers to their data — unlike most V8 heap objects, which use compressed 32-bit offsets. That exception was the specific attack surface this gadget used. The V8 Sandbox, once deployed, removes raw 64-bit pointers from large portions of the heap, eliminating this particular primitive.

A single Spectre observation produces a timing signal of a few nanoseconds. A remote network timer fluctuates over microseconds to milliseconds. Without amplification, the signal drowns in noise.

The 2026 attack adapted a PLRU cache replacement technique published by Google Project Zero researchers Stephen Röttger and Artur Janc, which exploits the tree-based pseudo-LRU (PLRU) replacement policy used in most L1 CPU caches. In a tree-PLRU scheme, each cache set is organized as a binary tree. By accessing a precise pattern of memory addresses, an attacker can arrange for a target cache line to remain resident indefinitely — or be evicted very quickly — depending on whether it was initially present. This transforms a single, tiny cache timing event into a prolonged sequence of L1 hits or misses, making it readable through a noisy remote timer.

Cloudflare Workers deliberately freezes the resolution of local timers. Date.now() and performance.now() do not advance during synchronous execution. There is no SharedArrayBuffer and no multithreading — the two standard methods for building a counter-based timer. Workers are designed from the ground up to deprive attackers of the precise timing information Spectre requires.

Researchers bypassed this by sending timing requests to an external server over a WebSocket connection. The server returned high-resolution timestamps on demand. The resulting remote timer was noisy, but the PLRU amplification made the signal large enough to classify individual bits reliably — even over geographic distances between the Cloudflare data center and the timing server. Details of the WebSocket remote timer technique confirm sub-millisecond median resolution was achievable with a small number of samples.

DyPrIs, Cloudflare's behavioral detection system deployed in 2021, watches hardware performance counters and flags scripts that generate anomalous branch-misprediction patterns — the statistical signature of an in-flight Spectre attempt. Scripts identified as suspicious are moved into separate OS processes, cutting off their access to neighboring tenant memory. Two specific properties of the 2026 attack kept it undetected.

DyPrIs evaluates a script's behavior after its invocation finishes. A short-lived Worker that runs for 30 seconds and completes can be evaluated and quarantined. An invocation that never ends cannot be isolated post-completion.

Cloudflare Durable Objects — a coordination primitive designed for real-time WebSocket state management — allow a script to maintain a live WebSocket connection indefinitely. The researchers evaded DyPrIs behavioral detection by using a Durable Object to hold a single invocation open by sending periodic keep-alive messages over a WebSocket. This kept one isolate alive for anywhere from five to more than 20 hours. The full JWT exfiltration completed long before DyPrIs's post-invocation isolation would ever trigger.

DyPrIs normalizes branch misprediction counts against instruction TLB (iTLB) activity to avoid false positives on legitimate I/O-heavy Workers. The WebSocket-intensive remote timer loop generated heavy iTLB activity. This deflated the normalized misprediction ratio below the detection threshold. From the defense system's perspective, the malicious Worker was indistinguishable from an ordinary network-heavy script.

For the attack to work, the attacker's isolate and the victim's isolate must run in the same OS process on the same physical server. One might assume this is difficult to arrange across Cloudflare's global network of tens of thousands of edge servers — but the researchers found it was not. Invoking a victim Worker from an attacker Worker using a simple fetch() subrequest typically causes the scheduler to spin up the victim in the same process. The researchers exploited scheduler co-location by targeting a low-traffic data center — such as an Australian server during European business hours — which reduced CPU load and improved signal quality further.

A fully formed JWT used for user authentication runs anywhere from a few hundred to a few thousand bits. At 12 bits per second, even a conservative estimate puts full token exfiltration under three minutes. An attacker with a stolen JWT can impersonate the victim's session at the application layer with no evidence of compromise in application logs, no network intrusion, and no vulnerability in the victim's code. The attack requires only a paid or free Cloudflare Workers subscription to execute — the attacker needs no privileged access to Cloudflare's infrastructure.

Cloudflare deployed three complementary mitigations, each targeting a different layer of the attack.

Google's V8 memory sandbox project, a multi-year effort, removes raw 64-bit pointers from large portions of the JavaScript heap by replacing them with 32-bit compressed offsets relative to a sandboxed base address. The V8 Sandbox mitigation deployed in Workers means the specific speculative type-confusion gadget the 2026 research depended on cannot construct an arbitrary-address read primitive. The V8 Sandbox does not eliminate all Spectre variants — other gadgets may exist — but it removes the specific entry point this attack chain used.

In September 2025, Cloudflare deployed Memory Protection Keys isolation using Intel Memory Protection Keys. MPK allows a process to assign each memory region a hardware protection key and switch access rights per-thread with a single CPU instruction (WRPKRU) at very low overhead. Each Workers isolate heap now carries a distinct hardware key. A speculative read that crosses isolate boundaries hits a page protected with a different key, and the hardware denies access. Cloudflare's implementation assigns keys across a tightly packed layout of sandbox regions so that any in-sandbox array access attempting to reach outside its boundary will encounter a differently keyed sandbox, triggering a hardware trap in close to 100% of cases rather than the approximately 92%.

MPK is not a complete Spectre fix — the hardware boundary reduction is substantial but not total — but it removes the straightforward cross-isolate heap read that the 2026 JWT exfiltration depended on.

Cloudflare updated Dynamic Process Isolation so that long-lived invocations and I/O-heavy Workers are treated as first-class security cases rather than background noise. Detection can no longer wait for a script to finish executing; Durable Object and WebSocket-heavy Workers are now monitored on an ongoing basis. Cloudflare is also investigating whether the distinctive timing pattern of a remote-timer-based Spectre attack — rapid alternation between heavy computation and WebSocket round-trips — can be added as a new behavioral detection dimension. The improved behavioral detection represents the third layer of the defense-in-depth response.

The shared-process, V8-isolate-based multi-tenant architecture that makes Cloudflare Workers efficient is also the architecture used by Deno Deploy, Fastly Compute@Edge, and Shopify Oxygen, among other V8-based edge compute platforms. These platforms run untrusted code from many tenants within shared OS processes, using isolates rather than process-level separation for density and cold-start performance.

This research is therefore not a Cloudflare-specific disclosure. It is a proof-of-concept for a class of attacks against an architectural pattern shared across a significant portion of the serverless edge compute industry. Every provider using the shared-process V8 isolate model inherits the same fundamental Spectre attack surface. The specific gadget in the 2026 paper may not work against a provider that has already deployed the V8 Sandbox — but the signal amplification techniques and the behavioral-detection evasion methods are broadly applicable.

The speed improvement — 360× in five years, achieved through algorithm alone — also illustrates the broader pattern: published Spectre research builds cumulatively. Each new paper's techniques become building blocks for the . Detection-based defenses that assume the attack looks like the known version are structurally fragile.

The multi-layer response Cloudflare has deployed — V8 Sandbox plus MPK in-process isolation plus improved DyPrIs — is likely to become the reference architecture for V8-based multi-tenant edge compute broadly, much as DyPrIs itself became a reference architecture in 2021.

The 2026 attack used two legitimate platform features to avoid detection: Durable Objects (designed for WebSocket state coordination) to hold invocations open indefinitely, and the same WebSocket traffic to inflate iTLB activity and suppress the normalized misprediction signal DyPrIs watches for. Neither of these behaviors is anomalous in isolation — together, they made a running Spectre attack look like ordinary network-heavy JavaScript.

Cloudflare reported that it found no indicators of active exploitation over Cloudflare's three-year monitoring period before the disclosure. The attack was demonstrated only against Workers that the researchers themselves controlled. No third-party customer data was accessed.

Spectre exploits speculative execution — a performance feature built into modern CPUs — rather than a software bug. Because the CPU is performing the problematic behavior intentionally (to run faster), there is no simple code fix. Mitigation requires either hardware changes, performance-impacting software serialization, or architectural design choices like restricting timers and blocking shared memory — all of which Cloudflare Workers had already implemented before the 2026 attack was developed. The 2026 research shows that creative attackers can route around those mitigations using legitimate features of the platform.

MPK assigns each isolate's heap a hardware access key. When the CPU speculatively reads from a neighboring isolate's memory, it hits a page with a different key and the hardware denies access — even transiently. This does not eliminate all Spectre variants, but it removes the cross-isolate heap read that the 2026 JWT exfiltration specifically required. Combined with the V8 Sandbox (which removes raw 64-bit pointers) and improved behavioral detection, the new three-layer defense forces any future attacker to find a substantially different technique.