Escaping the Cloudflare sandbox

A research team found a disk isolation bug in Cloudflare Containers that let a sandbox read other customers' files, including directory listings, SQLite databases, Chromium profiles, .env files, and credential files; Cloudflare Sandboxes and Browser Run, which use the same disk implementation, were affected too. The team reported the vulnerability to Cloudflare on September 4, 2026, and Cloudflare fixed it shortly after, with the two parties publishing a joint write-up of the vulnerability, root cause, and fix. It is the sixth sandbox escape the team has published since July 2026, following SharedRoot (Claude Cowork), Beltdown (Claude Code), Beltdown2 (Cursor CLI), Docker's VMM, and OpenAI Codex's sandbox.

Our latest sandbox escape points to a broader pattern: isolation can fail in many ways. Our research team found a disk isolation bug in Cloudflare Containers that let a sandbox read other customers’ files: directory listings, SQLite databases, Chromium profiles, .env files, and credential files. Cloudflare Sandboxes and Browser Run use the same disk implementation and were affected too. We reported it to Cloudflare on September 4, 2026, and they fixed it shortly after. We worked with Cloudflare on a joint write-up of the vulnerability, the root cause, and the fix. Read the full technical breakdown on the Cloudflare blog. http://blog.cloudflare.com/containers-cross-tenant-vulnerability This is the sixth sandbox escape our team has published since July 2026, after SharedRoot Claude Cowork , Beltdown Claude Code , Beltdown2 Cursor CLI , Docker’s VMM, and OpenAI Codex’s sandbox.