A revisit of remote Spectre attacks on Cloudflare Workers

The team rebuilt a remote Spectre proof-of-concept on Cloudflare Workers’ production environment and demonstrated a reliable leak of up to 12 bits per second with 99% accuracy, exposing a flaw in the original Dynamic Process Isolation (DyPrIs) defense. In response, they upgraded DyPrIs, added the V8 Sandbox and an in-process isolation layer, and confirmed that the attack is now mitigated, with no evidence of exploitation in the past three years.