> as safely as multiple sites can coexist in Chrome tabs

Chrome tabs usually run in different processes. It sounds like Cloudflare is using JS isolates within the same process to run many customers.

This sounds scary to me. For security, the Chrome team assumes that any code running in the same process has access to the whole address space of that process due to all of the recent speculative execution issues (Spectre/Meltdown).

I've seen comments on HN say that this isn't a problem for cloudflare because they do special things with all of JS timing APIs and a few others to mitigate.

Will be interesting if they are able to make this secure. Millisecond cold startup times will be amazing for development.