Safe in the sandbox: security hardening for Cloudflare Workers

Safe in the sandbox explains how Cloudflare is hardening Workers security by extending V8-based containment. The post notes that Memory Protection Keys are used to isolate V8 isolates from one another, with around 12 keys available for use, yielding a high likelihood of trapping an attacker within the intended memory region. It describes the V8 sandbox as a software boundary designed to prevent a heap corruption from escalating and to remove pointers from the heap where possible.

To strengthen this further, Cloudflare commissioned Igalia to add isolate groups, enabling multiple isolates per sandbox while currently placing a single isolate in each sandbox. A sandbox reserves 8 GiB of virtual memory per isolate, with the first 4 GiB forming the pointer cage and using 32‑bit offsets to keep data contained.

The piece also states that upgrading to memory protection keys in this layout eliminates the 92% protection gap in the threat model, bringing memory access under tighter control, according to Cloudflare.