Cloudflare Workers Spectre Attack Leaks JWT From Co-Located Worker at 12 Bits/Second

Researchers demonstrated a remote Spectre-class side-channel attack against Cloudflare Workers that exploited weaknesses in Dynamic Process Isolation (DyPrIs) and the V8 sandbox, successfully extracting a JWT token from a co-located worker at 12 bits/second — a significant improvement over prior benchmarks. The root cause lies in insufficient hardware-level memory isolation between tenant workloads sharing the same physical infrastructure, a systemic risk in multi-tenant edge compute environments. This matters because sensitive tokens, credentials, and cryptographic material processed in shared environments can be exfiltrated without any traditional exploit, leaving no obvious indicators of compromise. Cloud providers and developers alike must treat speculative execution vulnerabilities as an ongoing architectural threat, not a one-time patch event.