Cloudflare CDN Bug Outs User Locations on Signal, Discord

A researcher disclosed a flaw in Cloudflare’s content caching workflow and a related Cloudflare Workers issue that can be abused to determine a target’s approximate physical location (within ~250 miles) by forcing an app to load cached images from a specific Cloudflare datacenter; the technique can be delivered via one-click or zero-click vectors (demonstrated against Signal and Discord). Cloudflare fixed the Workers bug, but the researcher showed a VPN-based method to reach many datacenters nonetheless, and warned that any app using CDNs for caching may be at risk—posing a significant privacy threat to journalists, activists and other location-sensitive users.