Vulnerability
Class of transient-execution attacks that exploit CPU branch prediction to speculatively access and leak memory via microarchitectural side channels.
Researchers read a token out of a co-located Worker in Cloudflare's production fleet, 360 times faster than the 2021 demo that justified language-level isolation.
Reality
CSAIL researchers timed an interrupt to land inside the gap AMD's saferet defense leaves open, then pulled the root password file off a current Linux kernel. AMD has shipped a mitigation. Intel's picture is messier.
Reality
A 40-move review costs 160 core-seconds that nobody can cache. Compiling Stockfish to WebAssembly takes that off the server ledger and puts it on hardware you cannot measure.
Reality
The leak ran at 99% accuracy and traced to a limitation in Dynamic Process Isolation, the heuristic that quarantines suspicious Workers. Detection was never the durable layer.
Reality
An internal proof-of-concept leaked up to 12 bit/s at 99 percent accuracy inside production Workers by exploiting a limitation in Dynamic Process Isolation. Cloudflare says the gap is now closed.
Reality