When Agentic Glue Melts: Exploiting Cloudflare Code Mode and Workers

shahartal

Author here (Yarden & Shahar from Check Point Research). Context on what this is and isn't: We set out to break Cloudflare's Code Mode and ended up in workerd, the runtime underneath both Code Mode and Cloudflare Workers. Five memory-corruption bugs in workerd's native C++ "glue" (the layer that hands C++ objects to untrusted JS), two rated Critical by Cloudflare. We chained them into two end-to-end attacks: a cross-tenant heap read that swipes another Worker's secrets, and a Code Mode sandbox escape that goes from a single prompt injection to native code on the host. The core insight: the V8 "cage" and memory-protection keys don't cover the tcmalloc native heap - and that's exactly where the glue layer allocates its objects. If the cage is your isolation story, the memory it doesn't cover is your attack surface. Honest caveats: both full exploits were verified on self-hosted workerd, not run against Cloudflare production. The cross-tenant path should behave the same in prod since it runs entirely on the uncovered tcmalloc heap, but we didn't test it there. Cloudflare has fixed managed Workers in production; self-hosted deployments should update to workerd v1.20260619.1. No CVEs assigned or advisories issued by Cloudflare policy. Happy to answer questions.